# Flog Txt Version 1 # Analyzer Version: 2.4.0 # Analyzer Build Date: Jul 24 2018 18:08:56 # Log Creation Date: 08.09.2018 08:53:59.842 Process: id = "1" image_name = "ligma.exe" filename = "c:\\users\\ciihmnxmn6ps\\desktop\\ligma.exe" page_root = "0x20f0b000" os_pid = "0x950" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\LIGMA.exe\" " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013c81" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0xf00000 end_va = 0xf13fff entry_point = 0xf00000 region_type = mapped_file name = "ligma.exe" filename = "\\Users\\CIiHmnxMn6Ps\\Desktop\\LIGMA.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ligma.exe") Region: id = 2 start_va = 0xf20000 end_va = 0xf3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 3 start_va = 0xf40000 end_va = 0xf40fff entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 4 start_va = 0xf50000 end_va = 0xf63fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f50000" filename = "" Region: id = 5 start_va = 0xf70000 end_va = 0xfaffff entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 6 start_va = 0xfb0000 end_va = 0x10affff entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 7 start_va = 0x10b0000 end_va = 0x10b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010b0000" filename = "" Region: id = 8 start_va = 0x10c0000 end_va = 0x10c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010c0000" filename = "" Region: id = 9 start_va = 0x10d0000 end_va = 0x10d1fff entry_point = 0x0 region_type = private name = "private_0x00000000010d0000" filename = "" Region: id = 10 start_va = 0x77990000 end_va = 0x77b08fff entry_point = 0x77990000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 11 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 12 start_va = 0xfed20000 end_va = 0xfed42fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fed20000" filename = "" Region: id = 13 start_va = 0xfed48000 end_va = 0xfed48fff entry_point = 0x0 region_type = private name = "private_0x00000000fed48000" filename = "" Region: id = 14 start_va = 0xfed4c000 end_va = 0xfed4efff entry_point = 0x0 region_type = private name = "private_0x00000000fed4c000" filename = "" Region: id = 15 start_va = 0xfed4f000 end_va = 0xfed4ffff entry_point = 0x0 region_type = private name = "private_0x00000000fed4f000" filename = "" Region: id = 16 start_va = 0xfffe0000 end_va = 0x7ffaf7a0ffff entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 17 start_va = 0x7ffaf7a10000 end_va = 0x7ffaf7bd1fff entry_point = 0x7ffaf7a10000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 18 start_va = 0x7ffaf7bd2000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffaf7bd2000" filename = "" Region: id = 165 start_va = 0x1270000 end_va = 0x127ffff entry_point = 0x0 region_type = private name = "private_0x0000000001270000" filename = "" Region: id = 166 start_va = 0x73040000 end_va = 0x7308efff entry_point = 0x73040000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 167 start_va = 0x73090000 end_va = 0x73102fff entry_point = 0x73090000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 168 start_va = 0x73030000 end_va = 0x73037fff entry_point = 0x73030000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 169 start_va = 0x1400000 end_va = 0x14fffff entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 170 start_va = 0x74890000 end_va = 0x748e8fff entry_point = 0x74890000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 171 start_va = 0x74d30000 end_va = 0x74ea5fff entry_point = 0x74d30000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 172 start_va = 0x75130000 end_va = 0x7521ffff entry_point = 0x75130000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 173 start_va = 0xf20000 end_va = 0xf2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f20000" filename = "" Region: id = 174 start_va = 0x10e0000 end_va = 0x119dfff entry_point = 0x10e0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 175 start_va = 0x16d0000 end_va = 0x16dffff entry_point = 0x0 region_type = private name = "private_0x00000000016d0000" filename = "" Region: id = 176 start_va = 0x74990000 end_va = 0x74a20fff entry_point = 0x74990000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 177 start_va = 0x7fff0000 end_va = 0x7fffffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 178 start_va = 0x80000000 end_va = 0x8000ffff entry_point = 0x0 region_type = private name = "private_0x0000000080000000" filename = "" Region: id = 179 start_va = 0xfec20000 end_va = 0xfed1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fec20000" filename = "" Region: id = 180 start_va = 0xf30000 end_va = 0xf33fff entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 181 start_va = 0x11a0000 end_va = 0x11dffff entry_point = 0x0 region_type = private name = "private_0x00000000011a0000" filename = "" Region: id = 182 start_va = 0x1280000 end_va = 0x137ffff entry_point = 0x0 region_type = private name = "private_0x0000000001280000" filename = "" Region: id = 183 start_va = 0x74a30000 end_va = 0x74a88fff entry_point = 0x74a30000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 184 start_va = 0x74a90000 end_va = 0x74a99fff entry_point = 0x74a90000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 185 start_va = 0x74aa0000 end_va = 0x74abdfff entry_point = 0x74aa0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 186 start_va = 0x74c60000 end_va = 0x74cdafff entry_point = 0x74c60000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 187 start_va = 0x770b0000 end_va = 0x770f2fff entry_point = 0x770b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 188 start_va = 0x772c0000 end_va = 0x7736bfff entry_point = 0x772c0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 189 start_va = 0x778d0000 end_va = 0x7798dfff entry_point = 0x778d0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 190 start_va = 0xfed49000 end_va = 0xfed4bfff entry_point = 0x0 region_type = private name = "private_0x00000000fed49000" filename = "" Region: id = 191 start_va = 0xf40000 end_va = 0xf4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 192 start_va = 0x74810000 end_va = 0x74887fff entry_point = 0x74810000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 193 start_va = 0x74ad0000 end_va = 0x74c0ffff entry_point = 0x74ad0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 194 start_va = 0x74c10000 end_va = 0x74c53fff entry_point = 0x74c10000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 195 start_va = 0x74f70000 end_va = 0x75129fff entry_point = 0x74f70000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 196 start_va = 0x77370000 end_va = 0x774bcfff entry_point = 0x77370000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 197 start_va = 0x1500000 end_va = 0x1687fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001500000" filename = "" Region: id = 198 start_va = 0x75220000 end_va = 0x7524afff entry_point = 0x75220000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 199 start_va = 0x76da0000 end_va = 0x76ebffff entry_point = 0x76da0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 200 start_va = 0x11e0000 end_va = 0x11e0fff entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 201 start_va = 0x11f0000 end_va = 0x11f0fff entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 202 start_va = 0x16e0000 end_va = 0x1860fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000016e0000" filename = "" Region: id = 203 start_va = 0x1870000 end_va = 0x2c6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001870000" filename = "" Region: id = 204 start_va = 0x752b0000 end_va = 0x752bbfff entry_point = 0x752b0000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 205 start_va = 0x74800000 end_va = 0x74807fff entry_point = 0x74800000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 206 start_va = 0x74050000 end_va = 0x74144fff entry_point = 0x74050000 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 207 start_va = 0x74150000 end_va = 0x747f7fff entry_point = 0x74150000 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 208 start_va = 0x1200000 end_va = 0x1200fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001200000" filename = "" Region: id = 209 start_va = 0x1210000 end_va = 0x121ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001210000" filename = "" Region: id = 210 start_va = 0x1220000 end_va = 0x122ffff entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 211 start_va = 0x1230000 end_va = 0x123ffff entry_point = 0x0 region_type = private name = "private_0x0000000001230000" filename = "" Region: id = 212 start_va = 0x1240000 end_va = 0x124ffff entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 213 start_va = 0x1250000 end_va = 0x125ffff entry_point = 0x0 region_type = private name = "private_0x0000000001250000" filename = "" Region: id = 214 start_va = 0x1260000 end_va = 0x126ffff entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 215 start_va = 0x1380000 end_va = 0x1380fff entry_point = 0x0 region_type = private name = "private_0x0000000001380000" filename = "" Region: id = 216 start_va = 0x1390000 end_va = 0x1390fff entry_point = 0x0 region_type = private name = "private_0x0000000001390000" filename = "" Region: id = 217 start_va = 0x13a0000 end_va = 0x13dffff entry_point = 0x0 region_type = private name = "private_0x00000000013a0000" filename = "" Region: id = 218 start_va = 0x1690000 end_va = 0x16cffff entry_point = 0x0 region_type = private name = "private_0x0000000001690000" filename = "" Region: id = 219 start_va = 0x2c70000 end_va = 0x2d6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c70000" filename = "" Region: id = 220 start_va = 0x2da0000 end_va = 0x2daffff entry_point = 0x0 region_type = private name = "private_0x0000000002da0000" filename = "" Region: id = 221 start_va = 0x2de0000 end_va = 0x2deffff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 222 start_va = 0x2df0000 end_va = 0x4deffff entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 223 start_va = 0x4df0000 end_va = 0x4e8ffff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 224 start_va = 0x4e90000 end_va = 0x4f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e90000" filename = "" Region: id = 225 start_va = 0x4f90000 end_va = 0x52c6fff entry_point = 0x4f90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 226 start_va = 0x71e00000 end_va = 0x7302afff entry_point = 0x71e00000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b957e2761f39c847be8972eb3cccfc50\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b957e2761f39c847be8972eb3cccfc50\\mscorlib.ni.dll") Region: id = 227 start_va = 0xfec1d000 end_va = 0xfec1ffff entry_point = 0x0 region_type = private name = "private_0x00000000fec1d000" filename = "" Region: id = 228 start_va = 0xfed45000 end_va = 0xfed47fff entry_point = 0x0 region_type = private name = "private_0x00000000fed45000" filename = "" Region: id = 229 start_va = 0x76f30000 end_va = 0x77019fff entry_point = 0x76f30000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 230 start_va = 0x74910000 end_va = 0x74984fff entry_point = 0x74910000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 231 start_va = 0x52d0000 end_va = 0x54cffff entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 232 start_va = 0x13e0000 end_va = 0x13effff entry_point = 0x0 region_type = private name = "private_0x00000000013e0000" filename = "" Region: id = 233 start_va = 0x73fd0000 end_va = 0x7404cfff entry_point = 0x73fd0000 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 234 start_va = 0x76ce0000 end_va = 0x76d71fff entry_point = 0x76ce0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 235 start_va = 0x13f0000 end_va = 0x13fffff entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 236 start_va = 0x2d70000 end_va = 0x2d9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d70000" filename = "" Region: id = 237 start_va = 0x2db0000 end_va = 0x2dbffff entry_point = 0x0 region_type = private name = "private_0x0000000002db0000" filename = "" Region: id = 238 start_va = 0x2dc0000 end_va = 0x2dcffff entry_point = 0x0 region_type = private name = "private_0x0000000002dc0000" filename = "" Region: id = 239 start_va = 0x2dd0000 end_va = 0x2ddffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 240 start_va = 0x52d0000 end_va = 0x52d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052d0000" filename = "" Region: id = 241 start_va = 0x54c0000 end_va = 0x54cffff entry_point = 0x0 region_type = private name = "private_0x00000000054c0000" filename = "" Region: id = 242 start_va = 0x5970000 end_va = 0x5e07fff entry_point = 0x5970000 region_type = mapped_file name = "system.windows.forms.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll") Region: id = 243 start_va = 0x73620000 end_va = 0x73fccfff entry_point = 0x73620000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\5f1446a71be2a15498bce902bc345747\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\5f1446a71be2a15498bce902bc345747\\system.ni.dll") Region: id = 244 start_va = 0x52d0000 end_va = 0x52d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052d0000" filename = "" Region: id = 245 start_va = 0x52e0000 end_va = 0x52effff entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 246 start_va = 0x52f0000 end_va = 0x52fffff entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 247 start_va = 0x5380000 end_va = 0x540ffff entry_point = 0x5380000 region_type = mapped_file name = "system.drawing.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\system.drawing.dll") Region: id = 248 start_va = 0x5490000 end_va = 0x549ffff entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 249 start_va = 0x752c0000 end_va = 0x7667efff entry_point = 0x752c0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 250 start_va = 0x76800000 end_va = 0x76cdcfff entry_point = 0x76800000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 251 start_va = 0x771d0000 end_va = 0x7725cfff entry_point = 0x771d0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 252 start_va = 0x74ce0000 end_va = 0x74d23fff entry_point = 0x74ce0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 253 start_va = 0x77100000 end_va = 0x7710efff entry_point = 0x77100000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 254 start_va = 0x5e10000 end_va = 0x6301fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005e10000" filename = "" Region: id = 255 start_va = 0x6310000 end_va = 0x734ffff entry_point = 0x6310000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 256 start_va = 0x5300000 end_va = 0x5300fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005300000" filename = "" Region: id = 257 start_va = 0x54d0000 end_va = 0x5587fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000054d0000" filename = "" Region: id = 258 start_va = 0x5300000 end_va = 0x5303fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005300000" filename = "" Region: id = 259 start_va = 0x748f0000 end_va = 0x7490cfff entry_point = 0x748f0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 260 start_va = 0x5310000 end_va = 0x5314fff entry_point = 0x5310000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 261 start_va = 0x73410000 end_va = 0x73618fff entry_point = 0x73410000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll") Region: id = 262 start_va = 0x5320000 end_va = 0x5320fff entry_point = 0x5320000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 263 start_va = 0x5330000 end_va = 0x5331fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005330000" filename = "" Region: id = 264 start_va = 0x5320000 end_va = 0x5323fff entry_point = 0x0 region_type = private name = "private_0x0000000005320000" filename = "" Region: id = 265 start_va = 0x7350000 end_va = 0x9f62fff entry_point = 0x7350000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\SysWOW64\\imageres.dll" (normalized: "c:\\windows\\syswow64\\imageres.dll") Region: id = 266 start_va = 0x5340000 end_va = 0x5340fff entry_point = 0x5340000 region_type = mapped_file name = "imageres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\imageres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\imageres.dll.mui") Region: id = 267 start_va = 0x5350000 end_va = 0x5350fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005350000" filename = "" Region: id = 268 start_va = 0x5410000 end_va = 0x548ffff entry_point = 0x0 region_type = private name = "private_0x0000000005410000" filename = "" Region: id = 269 start_va = 0x5350000 end_va = 0x5350fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005350000" filename = "" Region: id = 270 start_va = 0x5590000 end_va = 0x55e5fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005590000" filename = "" Region: id = 271 start_va = 0x5360000 end_va = 0x5360fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005360000" filename = "" Region: id = 272 start_va = 0x5590000 end_va = 0x561efff entry_point = 0x5590000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_49c02355cf03478c\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_49c02355cf03478c\\comctl32.dll") Region: id = 273 start_va = 0x73370000 end_va = 0x73401fff entry_point = 0x73370000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_49c02355cf03478c\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_49c02355cf03478c\\comctl32.dll") Region: id = 274 start_va = 0x5590000 end_va = 0x564ffff entry_point = 0x0 region_type = private name = "private_0x0000000005590000" filename = "" Region: id = 275 start_va = 0x5360000 end_va = 0x536ffff entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 276 start_va = 0x5370000 end_va = 0x537ffff entry_point = 0x0 region_type = private name = "private_0x0000000005370000" filename = "" Region: id = 277 start_va = 0x54a0000 end_va = 0x54affff entry_point = 0x0 region_type = private name = "private_0x00000000054a0000" filename = "" Region: id = 278 start_va = 0x54a0000 end_va = 0x54affff entry_point = 0x0 region_type = private name = "private_0x00000000054a0000" filename = "" Region: id = 279 start_va = 0x54a0000 end_va = 0x54affff entry_point = 0x0 region_type = private name = "private_0x00000000054a0000" filename = "" Region: id = 280 start_va = 0x54b0000 end_va = 0x54bffff entry_point = 0x0 region_type = private name = "private_0x00000000054b0000" filename = "" Region: id = 281 start_va = 0x5590000 end_va = 0x559ffff entry_point = 0x0 region_type = private name = "private_0x0000000005590000" filename = "" Region: id = 282 start_va = 0x5640000 end_va = 0x564ffff entry_point = 0x0 region_type = private name = "private_0x0000000005640000" filename = "" Region: id = 283 start_va = 0x55a0000 end_va = 0x55affff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 284 start_va = 0x54b0000 end_va = 0x54b9fff entry_point = 0x54b0000 region_type = mapped_file name = "accessibility.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Accessibility.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\accessibility.dll") Region: id = 285 start_va = 0x54a0000 end_va = 0x54affff entry_point = 0x0 region_type = private name = "private_0x00000000054a0000" filename = "" Region: id = 286 start_va = 0x5590000 end_va = 0x559ffff entry_point = 0x0 region_type = private name = "private_0x0000000005590000" filename = "" Region: id = 287 start_va = 0x5590000 end_va = 0x559ffff entry_point = 0x0 region_type = private name = "private_0x0000000005590000" filename = "" Region: id = 288 start_va = 0x73200000 end_va = 0x7336afff entry_point = 0x73200000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll") Region: id = 289 start_va = 0x55a0000 end_va = 0x563ffff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 290 start_va = 0x55a0000 end_va = 0x55dffff entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 291 start_va = 0x5630000 end_va = 0x563ffff entry_point = 0x0 region_type = private name = "private_0x0000000005630000" filename = "" Region: id = 292 start_va = 0x5650000 end_va = 0x574ffff entry_point = 0x0 region_type = private name = "private_0x0000000005650000" filename = "" Region: id = 293 start_va = 0x71c10000 end_va = 0x71dfffff entry_point = 0x71c10000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll") Region: id = 294 start_va = 0xfec1a000 end_va = 0xfec1cfff entry_point = 0x0 region_type = private name = "private_0x00000000fec1a000" filename = "" Region: id = 295 start_va = 0x5750000 end_va = 0x57c5fff entry_point = 0x5750000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 296 start_va = 0x55e0000 end_va = 0x55e3fff entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 297 start_va = 0x57d0000 end_va = 0x58cffff entry_point = 0x0 region_type = private name = "private_0x00000000057d0000" filename = "" Region: id = 298 start_va = 0x9f70000 end_va = 0xaf6ffff entry_point = 0x9f70000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 299 start_va = 0x55f0000 end_va = 0x55f3fff entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 300 start_va = 0xaf70000 end_va = 0xb06ffff entry_point = 0x0 region_type = private name = "private_0x000000000af70000" filename = "" Region: id = 301 start_va = 0x5600000 end_va = 0x560ffff entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 302 start_va = 0x714f0000 end_va = 0x71c02fff entry_point = 0x714f0000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\112ea6c1fad3a35689011750e709399a\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\112ea6c1fad3a35689011750e709399a\\system.core.ni.dll") Region: id = 303 start_va = 0x731e0000 end_va = 0x731fafff entry_point = 0x731e0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 304 start_va = 0x731c0000 end_va = 0x731d2fff entry_point = 0x731c0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 305 start_va = 0x73190000 end_va = 0x731befff entry_point = 0x73190000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 308 start_va = 0xb070000 end_va = 0xb16ffff entry_point = 0x0 region_type = private name = "private_0x000000000b070000" filename = "" Region: id = 371 start_va = 0x1280000 end_va = 0x12e1fff entry_point = 0x1280000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 372 start_va = 0x12f0000 end_va = 0x132ffff entry_point = 0x0 region_type = private name = "private_0x00000000012f0000" filename = "" Region: id = 373 start_va = 0x1330000 end_va = 0x1330fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001330000" filename = "" Region: id = 374 start_va = 0x1340000 end_va = 0x137ffff entry_point = 0x0 region_type = private name = "private_0x0000000001340000" filename = "" Region: id = 375 start_va = 0x4df0000 end_va = 0x4e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 376 start_va = 0x4e30000 end_va = 0x4e6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e30000" filename = "" Region: id = 377 start_va = 0x58d0000 end_va = 0x590ffff entry_point = 0x0 region_type = private name = "private_0x00000000058d0000" filename = "" Region: id = 378 start_va = 0xb170000 end_va = 0xb26ffff entry_point = 0x0 region_type = private name = "private_0x000000000b170000" filename = "" Region: id = 379 start_va = 0xb270000 end_va = 0xb36ffff entry_point = 0x0 region_type = private name = "private_0x000000000b270000" filename = "" Region: id = 380 start_va = 0xb370000 end_va = 0xb46ffff entry_point = 0x0 region_type = private name = "private_0x000000000b370000" filename = "" Region: id = 381 start_va = 0xb470000 end_va = 0xb56ffff entry_point = 0x0 region_type = private name = "private_0x000000000b470000" filename = "" Region: id = 382 start_va = 0xb570000 end_va = 0xb66ffff entry_point = 0x0 region_type = private name = "private_0x000000000b570000" filename = "" Region: id = 383 start_va = 0xb670000 end_va = 0xb76ffff entry_point = 0x0 region_type = private name = "private_0x000000000b670000" filename = "" Region: id = 384 start_va = 0x15a50000 end_va = 0x164cffff entry_point = 0x0 region_type = private name = "private_0x0000000015a50000" filename = "" Region: id = 385 start_va = 0x71410000 end_va = 0x714ebfff entry_point = 0x71410000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\SysWOW64\\ucrtbase.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase.dll") Region: id = 386 start_va = 0x73160000 end_va = 0x73173fff entry_point = 0x73160000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\SysWOW64\\vcruntime140.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140.dll") Region: id = 387 start_va = 0x73180000 end_va = 0x73187fff entry_point = 0x73180000 region_type = mapped_file name = "payloads.dll" filename = "\\WinWOW32\\Payloads.dll" (normalized: "c:\\winwow32\\payloads.dll") Region: id = 388 start_va = 0xfec0b000 end_va = 0xfec0dfff entry_point = 0x0 region_type = private name = "private_0x00000000fec0b000" filename = "" Region: id = 389 start_va = 0xfec0e000 end_va = 0xfec10fff entry_point = 0x0 region_type = private name = "private_0x00000000fec0e000" filename = "" Region: id = 390 start_va = 0xfec11000 end_va = 0xfec13fff entry_point = 0x0 region_type = private name = "private_0x00000000fec11000" filename = "" Region: id = 391 start_va = 0xfec14000 end_va = 0xfec16fff entry_point = 0x0 region_type = private name = "private_0x00000000fec14000" filename = "" Region: id = 392 start_va = 0xfec17000 end_va = 0xfec19fff entry_point = 0x0 region_type = private name = "private_0x00000000fec17000" filename = "" Region: id = 410 start_va = 0xb770000 end_va = 0xb86ffff entry_point = 0x0 region_type = private name = "private_0x000000000b770000" filename = "" Thread: id = 1 os_tid = 0xa70 [0035.951] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0036.238] RoInitialize () returned 0x1 [0036.238] RoUninitialize () returned 0x0 [0036.720] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0036.809] IsAppThemed () returned 0x1 [0036.839] CoTaskMemAlloc (cb=0xf0) returned 0x145cfe8 [0036.839] CreateActCtxA (pActCtx=0x10af3c8) returned 0x14525bc [0036.850] CoTaskMemFree (pv=0x145cfe8) [0037.065] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc171 [0037.065] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc170 [0037.184] GetUserObjectInformationA (in: hObj=0xf4, nIndex=1, pvInfo=0x2df565c, nLength=0xc, lpnLengthNeeded=0x10af3f4 | out: pvInfo=0x2df565c, lpnLengthNeeded=0x10af3f4) returned 1 [0037.226] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x0 [0037.232] LoadLibraryW (lpLibFileName="shell32.dll") returned 0x752c0000 [0039.690] GetCurrentActCtx (in: lphActCtx=0x10af3f4 | out: lphActCtx=0x10af3f4*=0x0) returned 1 [0039.695] ActivateActCtx (in: hActCtx=0x14525bc, lpCookie=0x10af400 | out: hActCtx=0x14525bc, lpCookie=0x10af400) returned 1 [0039.719] GetCurrentProcess () returned 0xffffffff [0039.746] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x10af3e4, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x10af3e4*=0x2e4) returned 1 [0039.866] OleInitialize (pvReserved=0x0) returned 0x0 [0039.881] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x10af3ac | out: lplpMessageFilter=0x10af3ac*=0x0) returned 0x0 [0039.906] GetCurrentThreadId () returned 0xa70 [0039.919] EnumThreadWindows (dwThreadId=0xa70, lpfn=0x54905fe, lParam=0x0) returned 1 [0039.932] GetActiveWindow () returned 0x0 [0039.942] MessageBoxW (hWnd=0x0, lpText="The Program You Just Considered Running Is Classified as Malware\nTherefore Clicking Yes Will Infect Your System\nAre You Sure You Want To Execute It, Infecting Your System?", lpCaption="Disclaimer", uType=0x34) returned 6 [0041.019] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1b6b0001) returned 1 [0041.041] SendMessageW (hWnd=0x0, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0041.146] GetProcessWindowStation () returned 0xf4 [0041.146] GetActiveWindow () returned 0x0 [0041.147] GetModuleHandleW (lpModuleName="shell32.dll") returned 0x752c0000 [0041.147] GetCurrentActCtx (in: lphActCtx=0x10af3e8 | out: lphActCtx=0x10af3e8*=0x0) returned 1 [0041.147] ActivateActCtx (in: hActCtx=0x14525bc, lpCookie=0x10af3f4 | out: hActCtx=0x14525bc, lpCookie=0x10af3f4) returned 1 [0041.147] GetCurrentThreadId () returned 0xa70 [0041.147] EnumThreadWindows (dwThreadId=0xa70, lpfn=0x5490626, lParam=0x0) returned 1 [0041.147] GetActiveWindow () returned 0x0 [0041.147] GetFocus () returned 0x0 [0041.147] MessageBoxW (hWnd=0x0, lpText="This Trojan doesn't work on Windows 8 or 8.x\nPlease use Windows 7 to test this Trojan", lpCaption="LIGMA", uType=0x10) returned 1 [0041.319] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1b6b0004) returned 1 [0041.319] SendMessageW (hWnd=0x0, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0041.354] GetCurrentThreadId () returned 0xa70 [0041.367] GetCurrentThreadId () returned 0xa70 [0041.367] EnumThreadWindows (dwThreadId=0xa70, lpfn=0x549064e, lParam=0x0) returned 1 [0041.390] OleUninitialize () [0041.405] CloseHandle (hObject=0x2e4) returned 1 [0041.701] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0042.033] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x73370000 [0042.186] AdjustWindowRectEx (in: lpRect=0x10af410, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x10af410) returned 1 [0042.190] GetCurrentThread () returned 0xfffffffe [0042.190] GetCurrentProcess () returned 0xffffffff [0042.190] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x10af344, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x10af344*=0x318) returned 1 [0042.190] GetCurrentThreadId () returned 0xa70 [0042.268] GetCurrentActCtx (in: lphActCtx=0x10af2a4 | out: lphActCtx=0x10af2a4*=0x0) returned 1 [0042.268] ActivateActCtx (in: hActCtx=0x14525bc, lpCookie=0x10af2b0 | out: hActCtx=0x14525bc, lpCookie=0x10af2b0) returned 1 [0042.268] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73410000 [0042.304] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74ad0000 [0042.320] GetProcAddress (hModule=0x74ad0000, lpProcName="DefWindowProcW") returned 0x77a0caa0 [0042.324] GetStockObject (i=5) returned 0x1900015 [0042.340] GetModuleHandleW (lpModuleName=0x0) returned 0xf00000 [0042.347] CoTaskMemAlloc (cb=0x5c) returned 0x143f170 [0042.347] RegisterClassW (lpWndClass=0x10af154) returned 0xc140 [0042.347] CoTaskMemFree (pv=0x143f170) [0042.348] GetModuleHandleW (lpModuleName=0x0) returned 0xf00000 [0042.372] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0xf00000, lpParam=0x0) returned 0xa0096 [0042.379] SetWindowLongW (hWnd=0xa0096, nIndex=-4, dwNewLong=2007026336) returned 88671862 [0042.394] GetWindowLongW (hWnd=0xa0096, nIndex=-4) returned 2007026336 [0042.404] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x10ae9b0 | out: phkResult=0x10ae9b0*=0x31c) returned 0x0 [0042.405] RegQueryValueExW (in: hKey=0x31c, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x10ae9d0, lpData=0x0, lpcbData=0x10ae9cc*=0x0 | out: lpType=0x10ae9d0*=0x0, lpData=0x0, lpcbData=0x10ae9cc*=0x0) returned 0x2 [0042.405] RegQueryValueExW (in: hKey=0x31c, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x10ae9d0, lpData=0x0, lpcbData=0x10ae9cc*=0x0 | out: lpType=0x10ae9d0*=0x0, lpData=0x0, lpcbData=0x10ae9cc*=0x0) returned 0x2 [0042.405] RegCloseKey (hKey=0x31c) returned 0x0 [0042.426] SetWindowLongW (hWnd=0xa0096, nIndex=-4, dwNewLong=88671902) returned 2007026336 [0042.426] GetWindowLongW (hWnd=0xa0096, nIndex=-4) returned 88671902 [0042.426] GetWindowLongW (hWnd=0xa0096, nIndex=-16) returned 113311744 [0042.486] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc169 [0042.488] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc167 [0042.489] CallWindowProcW (lpPrevWndFunc=0x77a0caa0, hWnd=0xa0096, Msg=0x81, wParam=0x0, lParam=0x10aecb8) returned 0x1 [0042.489] CallWindowProcW (lpPrevWndFunc=0x77a0caa0, hWnd=0xa0096, Msg=0x83, wParam=0x0, lParam=0x10aeca4) returned 0x0 [0042.490] CallWindowProcW (lpPrevWndFunc=0x77a0caa0, hWnd=0xa0096, Msg=0x1, wParam=0x0, lParam=0x10aecb8) returned 0x0 [0042.496] GetClientRect (in: hWnd=0xa0096, lpRect=0x10aea04 | out: lpRect=0x10aea04) returned 1 [0042.497] GetWindowRect (in: hWnd=0xa0096, lpRect=0x10aea04 | out: lpRect=0x10aea04) returned 1 [0042.582] GetParent (hWnd=0xa0096) returned 0x0 [0042.582] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1b6b0005) returned 1 [0042.598] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73370000 [0042.603] AdjustWindowRectEx (in: lpRect=0x10af3f4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x10af3f4) returned 1 [0042.607] GetSystemMetrics (nIndex=59) returned 1456 [0042.607] GetSystemMetrics (nIndex=60) returned 916 [0042.607] GetSystemMetrics (nIndex=34) returned 136 [0042.607] GetSystemMetrics (nIndex=35) returned 39 [0042.616] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73370000 [0042.616] AdjustWindowRectEx (in: lpRect=0x10af2f4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x10af2f4) returned 1 [0042.628] CreateCompatibleDC (hdc=0x0) returned 0x5d01075c [0042.631] GetSystemDefaultLCID () returned 0x409 [0042.633] GetStockObject (i=17) returned 0x10a0047 [0042.645] GetObjectW (in: h=0x10a0047, c=92, pv=0x10af180 | out: pv=0x10af180) returned 92 [0042.650] GetDC (hWnd=0x0) returned 0x2e01074a [0042.696] GdiplusStartup (in: token=0x52e5168, input=0x10ae758, output=0x10ae7a8 | out: token=0x52e5168, output=0x10ae7a8) returned 0x0 [0042.703] CoTaskMemAlloc (cb=0x5c) returned 0x143f170 [0042.704] GdipCreateFontFromLogfontW (hdc=0x2e01074a, logfont=0x143f170, font=0x10af248) returned 0x0 [0042.883] CoTaskMemFree (pv=0x143f170) [0042.884] CoTaskMemAlloc (cb=0x5c) returned 0x143f170 [0042.884] CoTaskMemFree (pv=0x143f170) [0042.884] CoTaskMemAlloc (cb=0x5c) returned 0x143f170 [0042.884] CoTaskMemFree (pv=0x143f170) [0042.892] GdipGetFontUnit (font=0x5631f08, unit=0x10af220) returned 0x0 [0042.894] GdipGetFontSize (font=0x5631f08, size=0x10af224) returned 0x0 [0042.896] GdipGetFontStyle (font=0x5631f08, style=0x10af21c) returned 0x0 [0042.898] GdipGetFamily (font=0x5631f08, family=0x10af218) returned 0x0 [0042.903] GdipGetFontSize (font=0x5631f08, size=0x2df8ef8) returned 0x0 [0042.909] ReleaseDC (hWnd=0x0, hDC=0x2e01074a) returned 1 [0042.922] GetDC (hWnd=0x0) returned 0x10105e0 [0042.923] GdipCreateFromHDC (hdc=0x10105e0, graphics=0x10af244) returned 0x0 [0042.940] GdipGetDpiY (graphics=0xaf7f260, dpi=0x2df9000) returned 0x0 [0042.943] GdipGetFontHeight (font=0x5631f08, graphics=0xaf7f260, height=0x10af23c) returned 0x0 [0042.946] GdipGetEmHeight (family=0xaf74f48, style=0, EmHeight=0x10af244) returned 0x0 [0042.947] GdipGetLineSpacing (family=0xaf74f48, style=0, LineSpacing=0x10af244) returned 0x0 [0042.950] GdipDeleteGraphics (graphics=0xaf7f260) returned 0x0 [0042.951] ReleaseDC (hWnd=0x0, hDC=0x10105e0) returned 1 [0042.959] GdipCreateFont (fontFamily=0xaf74f48, emSize=0x41040000, style=0, unit=0x3, font=0x2df8fc0) returned 0x0 [0042.959] GdipGetFontSize (font=0x563ef48, size=0x2df8fc4) returned 0x0 [0042.960] GdipDeleteFont (font=0x5631f08) returned 0x0 [0042.961] GetDC (hWnd=0x0) returned 0x10105e0 [0042.961] GdipCreateFromHDC (hdc=0x10105e0, graphics=0x10af268) returned 0x0 [0042.965] CoTaskMemAlloc (cb=0x5c) returned 0x143f170 [0042.965] GdipGetLogFontW (font=0x563ef48, graphics=0xaf7f260, logfontW=0x143f170) returned 0x0 [0042.966] CoTaskMemFree (pv=0x143f170) [0042.966] CoTaskMemAlloc (cb=0x5c) returned 0x143f170 [0042.966] CoTaskMemFree (pv=0x143f170) [0042.966] CoTaskMemAlloc (cb=0x5c) returned 0x143f170 [0042.967] CoTaskMemFree (pv=0x143f170) [0042.967] GdipDeleteGraphics (graphics=0xaf7f260) returned 0x0 [0042.967] ReleaseDC (hWnd=0x0, hDC=0x10105e0) returned 1 [0042.968] CoTaskMemAlloc (cb=0x5c) returned 0x143f170 [0042.968] CreateFontIndirectW (lplf=0x143f170) returned 0xb70a05ea [0042.968] CoTaskMemFree (pv=0x143f170) [0042.970] SelectObject (hdc=0x5d01075c, h=0xb70a05ea) returned 0x18a0048 [0042.972] GetTextMetricsW (in: hdc=0x5d01075c, lptm=0x10af340 | out: lptm=0x10af340) returned 1 [0042.975] GetTextExtentPoint32W (in: hdc=0x5d01075c, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x2df921c | out: psizl=0x2df921c) returned 1 [0042.975] SelectObject (hdc=0x5d01075c, h=0x18a0048) returned 0xb70a05ea [0042.978] DeleteDC (hdc=0x5d01075c) returned 1 [0042.996] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73370000 [0042.997] AdjustWindowRectEx (in: lpRect=0x10af11c, dwStyle=0x2c40000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x10af11c) returned 1 [0042.997] AdjustWindowRectEx (in: lpRect=0x10af2c8, dwStyle=0x22c40000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x10af2c8) returned 1 [0043.004] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73370000 [0043.004] AdjustWindowRectEx (in: lpRect=0x10af094, dwStyle=0x2c40000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x10af094) returned 1 [0043.004] AdjustWindowRectEx (in: lpRect=0x10af15c, dwStyle=0x22c40000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x10af15c) returned 1 [0043.007] GetSystemMetrics (nIndex=34) returned 136 [0043.008] GetSystemMetrics (nIndex=35) returned 39 [0043.008] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x73370000 [0043.008] AdjustWindowRectEx (in: lpRect=0x10af024, dwStyle=0x2c40000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x10af024) returned 1 [0043.008] AdjustWindowRectEx (in: lpRect=0x10af0d0, dwStyle=0x22c40000, bMenu=0, dwExStyle=0x10001 | out: lpRect=0x10af0d0) returned 1 [0043.696] CoTaskMemAlloc (cb=0x20c) returned 0x1474000 [0043.696] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x1474000 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0043.698] CoTaskMemFree (pv=0x1474000) [0043.698] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0043.698] CoTaskMemAlloc (cb=0x20c) returned 0x1473dd8 [0043.698] SHGetFolderPathW (in: hwnd=0x0, csidl=13, hToken=0x0, dwFlags=0x0, pszPath=0x1473dd8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Music") returned 0x0 [0043.699] CoTaskMemFree (pv=0x1473dd8) [0043.699] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0043.699] CoTaskMemAlloc (cb=0x20c) returned 0x1473dd8 [0043.699] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x1473dd8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Pictures") returned 0x0 [0043.699] CoTaskMemFree (pv=0x1473dd8) [0043.699] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0043.699] CoTaskMemAlloc (cb=0x20c) returned 0x14748a0 [0043.699] SHGetFolderPathW (in: hwnd=0x0, csidl=14, hToken=0x0, dwFlags=0x0, pszPath=0x14748a0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Videos") returned 0x0 [0043.700] CoTaskMemFree (pv=0x14748a0) [0043.700] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0043.700] CoTaskMemAlloc (cb=0x20c) returned 0x1474678 [0043.700] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1474678 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned 0x0 [0043.700] CoTaskMemFree (pv=0x1474678) [0043.700] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0043.701] CoTaskMemAlloc (cb=0x20c) returned 0x1473988 [0043.701] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1473988 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0043.701] CoTaskMemFree (pv=0x1473988) [0043.701] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0043.701] CoTaskMemAlloc (cb=0x20c) returned 0x14748a0 [0043.701] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x14748a0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0 [0043.702] CoTaskMemFree (pv=0x14748a0) [0043.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0043.702] CoTaskMemAlloc (cb=0x20c) returned 0x1473988 [0043.702] SHGetFolderPathW (in: hwnd=0x0, csidl=6, hToken=0x0, dwFlags=0x0, pszPath=0x1473988 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Favorites") returned 0x0 [0043.702] CoTaskMemFree (pv=0x1473988) [0043.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpFilePart=0x0) returned 0x1f [0043.703] CoTaskMemAlloc (cb=0x20c) returned 0x1474228 [0043.703] SHGetFolderPathW (in: hwnd=0x0, csidl=33, hToken=0x0, dwFlags=0x0, pszPath=0x1474228 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies") returned 0x0 [0043.703] CoTaskMemFree (pv=0x1474228) [0043.703] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies", lpFilePart=0x0) returned 0x41 [0043.703] CoTaskMemAlloc (cb=0x20c) returned 0x1474678 [0043.703] SHGetFolderPathW (in: hwnd=0x0, csidl=34, hToken=0x0, dwFlags=0x0, pszPath=0x1474678 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x0 [0043.704] CoTaskMemFree (pv=0x1474678) [0043.704] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x3d [0043.704] CoTaskMemAlloc (cb=0x20c) returned 0x14748a0 [0043.704] SHGetFolderPathW (in: hwnd=0x0, csidl=32, hToken=0x0, dwFlags=0x0, pszPath=0x14748a0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache") returned 0x0 [0043.704] CoTaskMemFree (pv=0x14748a0) [0043.704] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache", lpFilePart=0x0) returned 0x3f [0043.704] CoTaskMemAlloc (cb=0x20c) returned 0x1473988 [0043.704] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x1473988 | out: pszPath="C:\\ProgramData") returned 0x0 [0043.705] CoTaskMemFree (pv=0x1473988) [0043.705] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0043.705] CoTaskMemAlloc (cb=0x20c) returned 0x1470a88 [0043.705] SHGetFolderPathW (in: hwnd=0x0, csidl=46, hToken=0x0, dwFlags=0x0, pszPath=0x1470a88 | out: pszPath="C:\\Users\\Public\\Documents") returned 0x0 [0043.705] CoTaskMemFree (pv=0x1470a88) [0043.705] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0043.705] CoTaskMemAlloc (cb=0x20c) returned 0x1470860 [0043.705] SHGetFolderPathW (in: hwnd=0x0, csidl=25, hToken=0x0, dwFlags=0x0, pszPath=0x1470860 | out: pszPath="C:\\Users\\Public\\Desktop") returned 0x0 [0043.706] CoTaskMemFree (pv=0x1470860) [0043.706] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0043.706] CoTaskMemAlloc (cb=0x20c) returned 0x1470a88 [0043.706] SHGetFolderPathW (in: hwnd=0x0, csidl=53, hToken=0x0, dwFlags=0x0, pszPath=0x1470a88 | out: pszPath="C:\\Users\\Public\\Music") returned 0x0 [0043.706] CoTaskMemFree (pv=0x1470a88) [0043.706] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0043.706] CoTaskMemAlloc (cb=0x20c) returned 0x1471100 [0043.706] SHGetFolderPathW (in: hwnd=0x0, csidl=58, hToken=0x0, dwFlags=0x0, pszPath=0x1471100 | out: pszPath="") returned 0x80070002 [0043.707] CoTaskMemFree (pv=0x1471100) [0043.707] CoTaskMemAlloc (cb=0x20c) returned 0x1470a88 [0043.707] SHGetFolderPathW (in: hwnd=0x0, csidl=54, hToken=0x0, dwFlags=0x0, pszPath=0x1470a88 | out: pszPath="C:\\Users\\Public\\Pictures") returned 0x0 [0043.707] CoTaskMemFree (pv=0x1470a88) [0043.707] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0043.708] CoTaskMemAlloc (cb=0x20c) returned 0x1470cb0 [0043.708] SHGetFolderPathW (in: hwnd=0x0, csidl=45, hToken=0x0, dwFlags=0x0, pszPath=0x1470cb0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Templates") returned 0x0 [0043.708] CoTaskMemFree (pv=0x1470cb0) [0043.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x2a [0043.708] CoTaskMemAlloc (cb=0x20c) returned 0x146fb70 [0043.708] SHGetFolderPathW (in: hwnd=0x0, csidl=55, hToken=0x0, dwFlags=0x0, pszPath=0x146fb70 | out: pszPath="C:\\Users\\Public\\Videos") returned 0x0 [0043.709] CoTaskMemFree (pv=0x146fb70) [0043.709] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x10aee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0043.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af388) returned 1 [0043.737] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x10aee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0043.737] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", nBufferLength=0x105, lpBuffer=0x10aee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpFilePart=0x0) returned 0x1e [0043.738] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*", lpFindFileData=0x10af0b0 | out: lpFindFileData=0x10af0b0) returned 0x145bfc8 [0043.739] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.739] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.739] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.739] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.739] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.739] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.739] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.739] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.739] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.740] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.740] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.740] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.740] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.740] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.740] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.740] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.740] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.740] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.741] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.741] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.741] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.741] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.741] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.741] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.741] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.741] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.742] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.742] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.742] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.742] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.742] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.742] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.742] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 0 [0043.742] FindClose (in: hFindFile=0x145bfc8 | out: hFindFile=0x145bfc8) returned 1 [0043.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af348) returned 1 [0043.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af354) returned 1 [0043.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af388) returned 1 [0043.743] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x10aee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0043.743] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", nBufferLength=0x105, lpBuffer=0x10aee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpFilePart=0x0) returned 0x1e [0043.743] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*", lpFindFileData=0x10af0b0 | out: lpFindFileData=0x10af0b0) returned 0x145bfc8 [0043.743] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.743] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.743] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.744] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.744] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.744] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.744] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.744] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.744] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.744] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.744] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.744] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.744] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.744] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.745] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.745] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.745] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.745] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.745] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.745] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.745] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.745] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.745] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.745] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.745] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.746] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.746] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.746] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.746] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.746] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.746] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.746] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0043.746] FindNextFileW (in: hFindFile=0x145bfc8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 0 [0043.746] FindClose (in: hFindFile=0x145bfc8 | out: hFindFile=0x145bfc8) returned 1 [0043.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af348) returned 1 [0043.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af354) returned 1 [0043.769] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-hrD ctZ_IvrK7s.gif", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-hrD ctZ_IvrK7s.gif", lpFilePart=0x0) returned 0x31 [0043.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af26c) returned 1 [0043.769] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-hrD ctZ_IvrK7s.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-hrd ctz_ivrk7s.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x36c [0043.770] GetFileType (hFile=0x36c) returned 0x1 [0043.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0043.770] GetFileType (hFile=0x36c) returned 0x1 [0043.770] GetFileSize (in: hFile=0x36c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xa67 [0043.770] ReadFile (in: hFile=0x36c, lpBuffer=0x2e0947c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e0947c*, lpNumberOfBytesRead=0x10af320*=0xa67, lpOverlapped=0x0) returned 1 [0043.771] CloseHandle (hObject=0x36c) returned 1 [0043.793] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x10af388 | out: pfEnabled=0x10af388) returned 0x0 [0043.878] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x10aed28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0043.879] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x10aed8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0043.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1ec) returned 1 [0043.879] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x10af268 | out: lpFileInformation=0x10af268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319371f9, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0xf0c27aa0, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xf0c27aa0, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0043.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1e8) returned 1 [0043.973] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-hrD ctZ_IvrK7s.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-hrD ctZ_IvrK7s.gif.ForgiveME", lpFilePart=0x0) returned 0x3b [0043.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af254) returned 1 [0043.973] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-hrD ctZ_IvrK7s.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-hrd ctz_ivrk7s.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0043.974] GetFileType (hFile=0x398) returned 0x1 [0043.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0043.974] GetFileType (hFile=0x398) returned 0x1 [0043.974] WriteFile (in: hFile=0x398, lpBuffer=0x2e84bdc*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2e84bdc*, lpNumberOfBytesWritten=0x10af2e4*=0xa70, lpOverlapped=0x0) returned 1 [0043.975] CloseHandle (hObject=0x398) returned 1 [0043.977] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-hrD ctZ_IvrK7s.gif", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-hrD ctZ_IvrK7s.gif", lpFilePart=0x0) returned 0x31 [0043.977] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\-hrD ctZ_IvrK7s.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\-hrd ctz_ivrk7s.gif")) returned 1 [0043.980] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3nApnpXou.rtf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3nApnpXou.rtf", lpFilePart=0x0) returned 0x2b [0043.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af26c) returned 1 [0043.980] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3nApnpXou.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\3napnpxou.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0043.980] GetFileType (hFile=0x398) returned 0x1 [0043.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0043.980] GetFileType (hFile=0x398) returned 0x1 [0043.981] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x5b19 [0043.981] ReadFile (in: hFile=0x398, lpBuffer=0x2e85d94, nNumberOfBytesToRead=0x5b19, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e85d94*, lpNumberOfBytesRead=0x10af320*=0x5b19, lpOverlapped=0x0) returned 1 [0043.981] CloseHandle (hObject=0x398) returned 1 [0044.003] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3nApnpXou.rtf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3nApnpXou.rtf.ForgiveME", lpFilePart=0x0) returned 0x35 [0044.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af254) returned 1 [0044.003] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3nApnpXou.rtf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\3napnpxou.rtf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.003] GetFileType (hFile=0x398) returned 0x1 [0044.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.004] GetFileType (hFile=0x398) returned 0x1 [0044.004] WriteFile (in: hFile=0x398, lpBuffer=0x2eef3bc*, nNumberOfBytesToWrite=0x5b20, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2eef3bc*, lpNumberOfBytesWritten=0x10af310*=0x5b20, lpOverlapped=0x0) returned 1 [0044.005] CloseHandle (hObject=0x398) returned 1 [0044.006] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3nApnpXou.rtf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3nApnpXou.rtf", lpFilePart=0x0) returned 0x2b [0044.006] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\3nApnpXou.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\3napnpxou.rtf")) returned 1 [0044.009] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4D-RXRdL_2N.mp3", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4D-RXRdL_2N.mp3", lpFilePart=0x0) returned 0x2d [0044.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af26c) returned 1 [0044.009] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4D-RXRdL_2N.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4d-rxrdl_2n.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.009] GetFileType (hFile=0x398) returned 0x1 [0044.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.010] GetFileType (hFile=0x398) returned 0x1 [0044.010] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x4d63 [0044.010] ReadFile (in: hFile=0x398, lpBuffer=0x2ef51a0, nNumberOfBytesToRead=0x4d63, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ef51a0*, lpNumberOfBytesRead=0x10af320*=0x4d63, lpOverlapped=0x0) returned 1 [0044.011] CloseHandle (hObject=0x398) returned 1 [0044.039] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4D-RXRdL_2N.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4D-RXRdL_2N.mp3.ForgiveME", lpFilePart=0x0) returned 0x37 [0044.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af254) returned 1 [0044.039] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4D-RXRdL_2N.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4d-rxrdl_2n.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.040] GetFileType (hFile=0x398) returned 0x1 [0044.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.040] GetFileType (hFile=0x398) returned 0x1 [0044.040] WriteFile (in: hFile=0x398, lpBuffer=0x2f5a35c*, nNumberOfBytesToWrite=0x4d70, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f5a35c*, lpNumberOfBytesWritten=0x10af310*=0x4d70, lpOverlapped=0x0) returned 1 [0044.041] CloseHandle (hObject=0x398) returned 1 [0044.043] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4D-RXRdL_2N.mp3", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4D-RXRdL_2N.mp3", lpFilePart=0x0) returned 0x2d [0044.043] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4D-RXRdL_2N.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4d-rxrdl_2n.mp3")) returned 1 [0044.057] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4tl50FkWgJm.bmp", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4tl50FkWgJm.bmp", lpFilePart=0x0) returned 0x2d [0044.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af26c) returned 1 [0044.057] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4tl50FkWgJm.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4tl50fkwgjm.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.057] GetFileType (hFile=0x398) returned 0x1 [0044.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.057] GetFileType (hFile=0x398) returned 0x1 [0044.057] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x70e5 [0044.058] ReadFile (in: hFile=0x398, lpBuffer=0x2f5f39c, nNumberOfBytesToRead=0x70e5, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f5f39c*, lpNumberOfBytesRead=0x10af320*=0x70e5, lpOverlapped=0x0) returned 1 [0044.058] CloseHandle (hObject=0x398) returned 1 [0044.079] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4tl50FkWgJm.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4tl50FkWgJm.bmp.ForgiveME", lpFilePart=0x0) returned 0x37 [0044.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af254) returned 1 [0044.079] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4tl50FkWgJm.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4tl50fkwgjm.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.080] GetFileType (hFile=0x398) returned 0x1 [0044.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.080] GetFileType (hFile=0x398) returned 0x1 [0044.080] WriteFile (in: hFile=0x398, lpBuffer=0x2fcf6d8*, nNumberOfBytesToWrite=0x70f0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fcf6d8*, lpNumberOfBytesWritten=0x10af310*=0x70f0, lpOverlapped=0x0) returned 1 [0044.081] CloseHandle (hObject=0x398) returned 1 [0044.082] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4tl50FkWgJm.bmp", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4tl50FkWgJm.bmp", lpFilePart=0x0) returned 0x2d [0044.082] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4tl50FkWgJm.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4tl50fkwgjm.bmp")) returned 1 [0044.084] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8DAs79 _K.doc", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8DAs79 _K.doc", lpFilePart=0x0) returned 0x2b [0044.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af26c) returned 1 [0044.084] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8DAs79 _K.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8das79 _k.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.084] GetFileType (hFile=0x398) returned 0x1 [0044.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.084] GetFileType (hFile=0x398) returned 0x1 [0044.084] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x8b85 [0044.084] ReadFile (in: hFile=0x398, lpBuffer=0x2fd6a90, nNumberOfBytesToRead=0x8b85, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2fd6a90*, lpNumberOfBytesRead=0x10af320*=0x8b85, lpOverlapped=0x0) returned 1 [0044.085] CloseHandle (hObject=0x398) returned 1 [0044.127] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8DAs79 _K.doc.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8DAs79 _K.doc.ForgiveME", lpFilePart=0x0) returned 0x35 [0044.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af254) returned 1 [0044.128] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8DAs79 _K.doc.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8das79 _k.doc.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.130] GetFileType (hFile=0x398) returned 0x1 [0044.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.130] GetFileType (hFile=0x398) returned 0x1 [0044.130] WriteFile (in: hFile=0x398, lpBuffer=0x2e6e1a0*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e6e1a0*, lpNumberOfBytesWritten=0x10af310*=0x8b90, lpOverlapped=0x0) returned 1 [0044.131] CloseHandle (hObject=0x398) returned 1 [0044.132] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8DAs79 _K.doc", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8DAs79 _K.doc", lpFilePart=0x0) returned 0x2b [0044.132] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\8DAs79 _K.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\8das79 _k.doc")) returned 1 [0044.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CnWmKSFK768cf2Qzf.m4a", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CnWmKSFK768cf2Qzf.m4a", lpFilePart=0x0) returned 0x33 [0044.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af26c) returned 1 [0044.134] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CnWmKSFK768cf2Qzf.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cnwmksfk768cf2qzf.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.134] GetFileType (hFile=0x398) returned 0x1 [0044.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.134] GetFileType (hFile=0x398) returned 0x1 [0044.134] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x8c19 [0044.134] ReadFile (in: hFile=0x398, lpBuffer=0x2e7700c, nNumberOfBytesToRead=0x8c19, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e7700c*, lpNumberOfBytesRead=0x10af320*=0x8c19, lpOverlapped=0x0) returned 1 [0044.135] CloseHandle (hObject=0x398) returned 1 [0044.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CnWmKSFK768cf2Qzf.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CnWmKSFK768cf2Qzf.m4a.ForgiveME", lpFilePart=0x0) returned 0x3d [0044.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af254) returned 1 [0044.194] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CnWmKSFK768cf2Qzf.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cnwmksfk768cf2qzf.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.195] GetFileType (hFile=0x398) returned 0x1 [0044.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.195] GetFileType (hFile=0x398) returned 0x1 [0044.195] WriteFile (in: hFile=0x398, lpBuffer=0x2eefca0*, nNumberOfBytesToWrite=0x8c20, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2eefca0*, lpNumberOfBytesWritten=0x10af310*=0x8c20, lpOverlapped=0x0) returned 1 [0044.196] CloseHandle (hObject=0x398) returned 1 [0044.197] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CnWmKSFK768cf2Qzf.m4a", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CnWmKSFK768cf2Qzf.m4a", lpFilePart=0x0) returned 0x33 [0044.197] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CnWmKSFK768cf2Qzf.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cnwmksfk768cf2qzf.m4a")) returned 1 [0044.199] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CZiQMWk.avi", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CZiQMWk.avi", lpFilePart=0x0) returned 0x29 [0044.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af26c) returned 1 [0044.199] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CZiQMWk.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cziqmwk.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.199] GetFileType (hFile=0x398) returned 0x1 [0044.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.199] GetFileType (hFile=0x398) returned 0x1 [0044.199] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xd546 [0044.199] ReadFile (in: hFile=0x398, lpBuffer=0x2ef8ba4, nNumberOfBytesToRead=0xd546, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ef8ba4*, lpNumberOfBytesRead=0x10af320*=0xd546, lpOverlapped=0x0) returned 1 [0044.200] CloseHandle (hObject=0x398) returned 1 [0044.216] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CZiQMWk.avi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CZiQMWk.avi.ForgiveME", lpFilePart=0x0) returned 0x33 [0044.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af254) returned 1 [0044.216] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CZiQMWk.avi.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cziqmwk.avi.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.217] GetFileType (hFile=0x398) returned 0x1 [0044.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.217] GetFileType (hFile=0x398) returned 0x1 [0044.217] WriteFile (in: hFile=0x398, lpBuffer=0x2f6da2c*, nNumberOfBytesToWrite=0xd550, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f6da2c*, lpNumberOfBytesWritten=0x10af310*=0xd550, lpOverlapped=0x0) returned 1 [0044.218] CloseHandle (hObject=0x398) returned 1 [0044.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CZiQMWk.avi", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CZiQMWk.avi", lpFilePart=0x0) returned 0x29 [0044.220] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CZiQMWk.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cziqmwk.avi")) returned 1 [0044.221] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dIzOux_V.png", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dIzOux_V.png", lpFilePart=0x0) returned 0x2a [0044.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af26c) returned 1 [0044.221] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dIzOux_V.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dizoux_v.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.222] GetFileType (hFile=0x398) returned 0x1 [0044.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.222] GetFileType (hFile=0x398) returned 0x1 [0044.222] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xc940 [0044.222] ReadFile (in: hFile=0x398, lpBuffer=0x2f7b280, nNumberOfBytesToRead=0xc940, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f7b280*, lpNumberOfBytesRead=0x10af320*=0xc940, lpOverlapped=0x0) returned 1 [0044.223] CloseHandle (hObject=0x398) returned 1 [0044.238] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dIzOux_V.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dIzOux_V.png.ForgiveME", lpFilePart=0x0) returned 0x34 [0044.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af254) returned 1 [0044.238] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dIzOux_V.png.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dizoux_v.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.239] GetFileType (hFile=0x398) returned 0x1 [0044.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.239] GetFileType (hFile=0x398) returned 0x1 [0044.239] WriteFile (in: hFile=0x398, lpBuffer=0x2fedd08*, nNumberOfBytesToWrite=0xc950, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fedd08*, lpNumberOfBytesWritten=0x10af310*=0xc950, lpOverlapped=0x0) returned 1 [0044.240] CloseHandle (hObject=0x398) returned 1 [0044.242] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dIzOux_V.png", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dIzOux_V.png", lpFilePart=0x0) returned 0x2a [0044.242] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dIzOux_V.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dizoux_v.png")) returned 1 [0044.244] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EB G6qCWqieCGCoHg.ppt", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EB G6qCWqieCGCoHg.ppt", lpFilePart=0x0) returned 0x33 [0044.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af26c) returned 1 [0044.244] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EB G6qCWqieCGCoHg.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\eb g6qcwqiecgcohg.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.244] GetFileType (hFile=0x398) returned 0x1 [0044.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.244] GetFileType (hFile=0x398) returned 0x1 [0044.244] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x3bee [0044.244] ReadFile (in: hFile=0x398, lpBuffer=0x2ffa934, nNumberOfBytesToRead=0x3bee, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ffa934*, lpNumberOfBytesRead=0x10af320*=0x3bee, lpOverlapped=0x0) returned 1 [0044.245] CloseHandle (hObject=0x398) returned 1 [0044.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EB G6qCWqieCGCoHg.ppt.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EB G6qCWqieCGCoHg.ppt.ForgiveME", lpFilePart=0x0) returned 0x3d [0044.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af254) returned 1 [0044.263] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EB G6qCWqieCGCoHg.ppt.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\eb g6qcwqiecgcohg.ppt.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.263] GetFileType (hFile=0x398) returned 0x1 [0044.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.263] GetFileType (hFile=0x398) returned 0x1 [0044.264] WriteFile (in: hFile=0x398, lpBuffer=0x2e6e438*, nNumberOfBytesToWrite=0x3bf0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e6e438*, lpNumberOfBytesWritten=0x10af310*=0x3bf0, lpOverlapped=0x0) returned 1 [0044.264] CloseHandle (hObject=0x398) returned 1 [0044.266] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EB G6qCWqieCGCoHg.ppt", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EB G6qCWqieCGCoHg.ppt", lpFilePart=0x0) returned 0x33 [0044.266] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EB G6qCWqieCGCoHg.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\eb g6qcwqiecgcohg.ppt")) returned 1 [0044.268] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ED8z5hvaRbfKFmQSj.mp3", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ED8z5hvaRbfKFmQSj.mp3", lpFilePart=0x0) returned 0x33 [0044.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af26c) returned 1 [0044.268] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ED8z5hvaRbfKFmQSj.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ed8z5hvarbfkfmqsj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.268] GetFileType (hFile=0x398) returned 0x1 [0044.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.268] GetFileType (hFile=0x398) returned 0x1 [0044.268] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x15143 [0044.269] ReadFile (in: hFile=0x398, lpBuffer=0x3e2d610, nNumberOfBytesToRead=0x15143, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3e2d610*, lpNumberOfBytesRead=0x10af320*=0x15143, lpOverlapped=0x0) returned 1 [0044.271] CloseHandle (hObject=0x398) returned 1 [0044.290] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ED8z5hvaRbfKFmQSj.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ED8z5hvaRbfKFmQSj.mp3.ForgiveME", lpFilePart=0x0) returned 0x3d [0044.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af254) returned 1 [0044.290] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ED8z5hvaRbfKFmQSj.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ed8z5hvarbfkfmqsj.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.290] GetFileType (hFile=0x398) returned 0x1 [0044.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.291] GetFileType (hFile=0x398) returned 0x1 [0044.291] WriteFile (in: hFile=0x398, lpBuffer=0x3e96cd0*, nNumberOfBytesToWrite=0x15150, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3e96cd0*, lpNumberOfBytesWritten=0x10af310*=0x15150, lpOverlapped=0x0) returned 1 [0044.292] CloseHandle (hObject=0x398) returned 1 [0044.294] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ED8z5hvaRbfKFmQSj.mp3", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ED8z5hvaRbfKFmQSj.mp3", lpFilePart=0x0) returned 0x33 [0044.294] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ED8z5hvaRbfKFmQSj.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ed8z5hvarbfkfmqsj.mp3")) returned 1 [0044.296] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EHha1E7xs59mBr.avi", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EHha1E7xs59mBr.avi", lpFilePart=0x0) returned 0x30 [0044.296] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EHha1E7xs59mBr.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ehha1e7xs59mbr.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.296] GetFileType (hFile=0x398) returned 0x1 [0044.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.296] GetFileType (hFile=0x398) returned 0x1 [0044.296] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x189e3 [0044.296] ReadFile (in: hFile=0x398, lpBuffer=0x3eabe40, nNumberOfBytesToRead=0x189e3, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3eabe40*, lpNumberOfBytesRead=0x10af320*=0x189e3, lpOverlapped=0x0) returned 1 [0044.318] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EHha1E7xs59mBr.avi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EHha1E7xs59mBr.avi.ForgiveME", lpFilePart=0x0) returned 0x3a [0044.318] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EHha1E7xs59mBr.avi.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ehha1e7xs59mbr.avi.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.319] GetFileType (hFile=0x398) returned 0x1 [0044.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.319] GetFileType (hFile=0x398) returned 0x1 [0044.319] WriteFile (in: hFile=0x398, lpBuffer=0x3f27020*, nNumberOfBytesToWrite=0x189f0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3f27020*, lpNumberOfBytesWritten=0x10af310*=0x189f0, lpOverlapped=0x0) returned 1 [0044.321] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EHha1E7xs59mBr.avi", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EHha1E7xs59mBr.avi", lpFilePart=0x0) returned 0x30 [0044.321] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\EHha1E7xs59mBr.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ehha1e7xs59mbr.avi")) returned 1 [0044.323] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\enSgx.swf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\enSgx.swf", lpFilePart=0x0) returned 0x27 [0044.323] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\enSgx.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ensgx.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.323] GetFileType (hFile=0x398) returned 0x1 [0044.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.323] GetFileType (hFile=0x398) returned 0x1 [0044.323] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x7951 [0044.323] ReadFile (in: hFile=0x398, lpBuffer=0x2f0c7b0, nNumberOfBytesToRead=0x7951, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f0c7b0*, lpNumberOfBytesRead=0x10af320*=0x7951, lpOverlapped=0x0) returned 1 [0044.369] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\enSgx.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\enSgx.swf.ForgiveME", lpFilePart=0x0) returned 0x31 [0044.369] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\enSgx.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ensgx.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.372] GetFileType (hFile=0x398) returned 0x1 [0044.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.372] GetFileType (hFile=0x398) returned 0x1 [0044.372] WriteFile (in: hFile=0x398, lpBuffer=0x2f7f510*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f7f510*, lpNumberOfBytesWritten=0x10af310*=0x7960, lpOverlapped=0x0) returned 1 [0044.374] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\enSgx.swf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\enSgx.swf", lpFilePart=0x0) returned 0x27 [0044.374] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\enSgx.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ensgx.swf")) returned 1 [0044.375] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FtOvEI.csv", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FtOvEI.csv", lpFilePart=0x0) returned 0x28 [0044.375] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FtOvEI.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ftovei.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.375] GetFileType (hFile=0x398) returned 0x1 [0044.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.375] GetFileType (hFile=0x398) returned 0x1 [0044.375] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xc6be [0044.375] ReadFile (in: hFile=0x398, lpBuffer=0x2f8710c, nNumberOfBytesToRead=0xc6be, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f8710c*, lpNumberOfBytesRead=0x10af320*=0xc6be, lpOverlapped=0x0) returned 1 [0044.392] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FtOvEI.csv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FtOvEI.csv.ForgiveME", lpFilePart=0x0) returned 0x32 [0044.392] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FtOvEI.csv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ftovei.csv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.393] GetFileType (hFile=0x398) returned 0x1 [0044.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.393] GetFileType (hFile=0x398) returned 0x1 [0044.393] WriteFile (in: hFile=0x398, lpBuffer=0x2ff93e4*, nNumberOfBytesToWrite=0xc6c0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2ff93e4*, lpNumberOfBytesWritten=0x10af310*=0xc6c0, lpOverlapped=0x0) returned 1 [0044.395] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FtOvEI.csv", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FtOvEI.csv", lpFilePart=0x0) returned 0x28 [0044.395] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FtOvEI.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ftovei.csv")) returned 1 [0044.396] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Gz3fVmm7.flv", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Gz3fVmm7.flv", lpFilePart=0x0) returned 0x2a [0044.396] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Gz3fVmm7.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gz3fvmm7.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.396] GetFileType (hFile=0x398) returned 0x1 [0044.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.397] GetFileType (hFile=0x398) returned 0x1 [0044.397] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xdde1 [0044.397] ReadFile (in: hFile=0x398, lpBuffer=0x3005d54, nNumberOfBytesToRead=0xdde1, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3005d54*, lpNumberOfBytesRead=0x10af320*=0xdde1, lpOverlapped=0x0) returned 1 [0044.415] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Gz3fVmm7.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Gz3fVmm7.flv.ForgiveME", lpFilePart=0x0) returned 0x34 [0044.415] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Gz3fVmm7.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gz3fvmm7.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.416] GetFileType (hFile=0x398) returned 0x1 [0044.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.416] GetFileType (hFile=0x398) returned 0x1 [0044.416] WriteFile (in: hFile=0x398, lpBuffer=0x2e6be00*, nNumberOfBytesToWrite=0xddf0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e6be00*, lpNumberOfBytesWritten=0x10af310*=0xddf0, lpOverlapped=0x0) returned 1 [0044.418] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Gz3fVmm7.flv", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Gz3fVmm7.flv", lpFilePart=0x0) returned 0x2a [0044.418] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Gz3fVmm7.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gz3fvmm7.flv")) returned 1 [0044.429] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\h_hQxIcKkK0ptnyAnpx.odp", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\h_hQxIcKkK0ptnyAnpx.odp", lpFilePart=0x0) returned 0x35 [0044.429] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\h_hQxIcKkK0ptnyAnpx.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h_hqxickkk0ptnyanpx.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.429] GetFileType (hFile=0x398) returned 0x1 [0044.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.429] GetFileType (hFile=0x398) returned 0x1 [0044.429] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x105c2 [0044.429] ReadFile (in: hFile=0x398, lpBuffer=0x2e79f28, nNumberOfBytesToRead=0x105c2, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e79f28*, lpNumberOfBytesRead=0x10af320*=0x105c2, lpOverlapped=0x0) returned 1 [0044.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\h_hQxIcKkK0ptnyAnpx.odp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\h_hQxIcKkK0ptnyAnpx.odp.ForgiveME", lpFilePart=0x0) returned 0x3f [0044.446] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\h_hQxIcKkK0ptnyAnpx.odp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h_hqxickkk0ptnyanpx.odp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.448] GetFileType (hFile=0x398) returned 0x1 [0044.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.448] GetFileType (hFile=0x398) returned 0x1 [0044.448] WriteFile (in: hFile=0x398, lpBuffer=0x2ef80a4*, nNumberOfBytesToWrite=0x105d0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2ef80a4*, lpNumberOfBytesWritten=0x10af310*=0x105d0, lpOverlapped=0x0) returned 1 [0044.450] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\h_hQxIcKkK0ptnyAnpx.odp", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\h_hQxIcKkK0ptnyAnpx.odp", lpFilePart=0x0) returned 0x35 [0044.450] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\h_hQxIcKkK0ptnyAnpx.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h_hqxickkk0ptnyanpx.odp")) returned 1 [0044.452] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IoxULA_CkfpP.m4a", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IoxULA_CkfpP.m4a", lpFilePart=0x0) returned 0x2e [0044.452] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IoxULA_CkfpP.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ioxula_ckfpp.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.452] GetFileType (hFile=0x398) returned 0x1 [0044.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.452] GetFileType (hFile=0x398) returned 0x1 [0044.452] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x4842 [0044.452] ReadFile (in: hFile=0x398, lpBuffer=0x2f0897c, nNumberOfBytesToRead=0x4842, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f0897c*, lpNumberOfBytesRead=0x10af320*=0x4842, lpOverlapped=0x0) returned 1 [0044.466] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IoxULA_CkfpP.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IoxULA_CkfpP.m4a.ForgiveME", lpFilePart=0x0) returned 0x38 [0044.466] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IoxULA_CkfpP.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ioxula_ckfpp.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.467] GetFileType (hFile=0x398) returned 0x1 [0044.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.467] GetFileType (hFile=0x398) returned 0x1 [0044.467] WriteFile (in: hFile=0x398, lpBuffer=0x2f6c19c*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f6c19c*, lpNumberOfBytesWritten=0x10af310*=0x4850, lpOverlapped=0x0) returned 1 [0044.469] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IoxULA_CkfpP.m4a", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IoxULA_CkfpP.m4a", lpFilePart=0x0) returned 0x2e [0044.469] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IoxULA_CkfpP.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ioxula_ckfpp.m4a")) returned 1 [0044.470] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kSP1cnB2hxU7y.rtf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kSP1cnB2hxU7y.rtf", lpFilePart=0x0) returned 0x2f [0044.470] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kSP1cnB2hxU7y.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ksp1cnb2hxu7y.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.470] GetFileType (hFile=0x398) returned 0x1 [0044.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.470] GetFileType (hFile=0x398) returned 0x1 [0044.470] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xef0c [0044.470] ReadFile (in: hFile=0x398, lpBuffer=0x2f70cd0, nNumberOfBytesToRead=0xef0c, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f70cd0*, lpNumberOfBytesRead=0x10af320*=0xef0c, lpOverlapped=0x0) returned 1 [0044.486] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kSP1cnB2hxU7y.rtf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kSP1cnB2hxU7y.rtf.ForgiveME", lpFilePart=0x0) returned 0x39 [0044.486] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kSP1cnB2hxU7y.rtf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ksp1cnb2hxu7y.rtf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.487] GetFileType (hFile=0x398) returned 0x1 [0044.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.487] GetFileType (hFile=0x398) returned 0x1 [0044.487] WriteFile (in: hFile=0x398, lpBuffer=0x2fea8a0*, nNumberOfBytesToWrite=0xef10, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fea8a0*, lpNumberOfBytesWritten=0x10af310*=0xef10, lpOverlapped=0x0) returned 1 [0044.489] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kSP1cnB2hxU7y.rtf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kSP1cnB2hxU7y.rtf", lpFilePart=0x0) returned 0x2f [0044.489] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kSP1cnB2hxU7y.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ksp1cnb2hxu7y.rtf")) returned 1 [0044.490] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ll-GR eAmm.mp4", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ll-GR eAmm.mp4", lpFilePart=0x0) returned 0x2c [0044.490] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ll-GR eAmm.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ll-gr eamm.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.491] GetFileType (hFile=0x398) returned 0x1 [0044.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.491] GetFileType (hFile=0x398) returned 0x1 [0044.491] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xd9ac [0044.491] ReadFile (in: hFile=0x398, lpBuffer=0x2ff9ae0, nNumberOfBytesToRead=0xd9ac, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ff9ae0*, lpNumberOfBytesRead=0x10af320*=0xd9ac, lpOverlapped=0x0) returned 1 [0044.513] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ll-GR eAmm.mp4.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ll-GR eAmm.mp4.ForgiveME", lpFilePart=0x0) returned 0x36 [0044.513] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ll-GR eAmm.mp4.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ll-gr eamm.mp4.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.515] GetFileType (hFile=0x398) returned 0x1 [0044.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.515] GetFileType (hFile=0x398) returned 0x1 [0044.515] WriteFile (in: hFile=0x398, lpBuffer=0x2e7d80c*, nNumberOfBytesToWrite=0xd9b0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e7d80c*, lpNumberOfBytesWritten=0x10af310*=0xd9b0, lpOverlapped=0x0) returned 1 [0044.517] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ll-GR eAmm.mp4", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ll-GR eAmm.mp4", lpFilePart=0x0) returned 0x2c [0044.517] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ll-GR eAmm.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ll-gr eamm.mp4")) returned 1 [0044.518] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\MhC1R.jpg", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\MhC1R.jpg", lpFilePart=0x0) returned 0x27 [0044.518] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\MhC1R.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\mhc1r.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.519] GetFileType (hFile=0x398) returned 0x1 [0044.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.519] GetFileType (hFile=0x398) returned 0x1 [0044.519] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x542 [0044.519] ReadFile (in: hFile=0x398, lpBuffer=0x2e8b9c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e8b9c4*, lpNumberOfBytesRead=0x10af320*=0x542, lpOverlapped=0x0) returned 1 [0044.533] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\MhC1R.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\MhC1R.jpg.ForgiveME", lpFilePart=0x0) returned 0x31 [0044.533] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\MhC1R.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\mhc1r.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.533] GetFileType (hFile=0x398) returned 0x1 [0044.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.534] GetFileType (hFile=0x398) returned 0x1 [0044.534] WriteFile (in: hFile=0x398, lpBuffer=0x2edb548*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2edb548*, lpNumberOfBytesWritten=0x10af2e4*=0x550, lpOverlapped=0x0) returned 1 [0044.535] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\MhC1R.jpg", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\MhC1R.jpg", lpFilePart=0x0) returned 0x27 [0044.535] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\MhC1R.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\mhc1r.jpg")) returned 1 [0044.536] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qwV3dIWBMjgPTO.flv", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qwV3dIWBMjgPTO.flv", lpFilePart=0x0) returned 0x30 [0044.536] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qwV3dIWBMjgPTO.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qwv3diwbmjgpto.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.536] GetFileType (hFile=0x398) returned 0x1 [0044.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.536] GetFileType (hFile=0x398) returned 0x1 [0044.536] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xe3b1 [0044.536] ReadFile (in: hFile=0x398, lpBuffer=0x2edc704, nNumberOfBytesToRead=0xe3b1, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2edc704*, lpNumberOfBytesRead=0x10af320*=0xe3b1, lpOverlapped=0x0) returned 1 [0044.552] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qwV3dIWBMjgPTO.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qwV3dIWBMjgPTO.flv.ForgiveME", lpFilePart=0x0) returned 0x3a [0044.552] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qwV3dIWBMjgPTO.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qwv3diwbmjgpto.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.553] GetFileType (hFile=0x398) returned 0x1 [0044.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.553] GetFileType (hFile=0x398) returned 0x1 [0044.553] WriteFile (in: hFile=0x398, lpBuffer=0x2f540ec*, nNumberOfBytesToWrite=0xe3c0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f540ec*, lpNumberOfBytesWritten=0x10af310*=0xe3c0, lpOverlapped=0x0) returned 1 [0044.555] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qwV3dIWBMjgPTO.flv", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qwV3dIWBMjgPTO.flv", lpFilePart=0x0) returned 0x30 [0044.555] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qwV3dIWBMjgPTO.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qwv3diwbmjgpto.flv")) returned 1 [0044.556] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rTh9rihBLxNHPHI.bmp", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rTh9rihBLxNHPHI.bmp", lpFilePart=0x0) returned 0x31 [0044.556] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rTh9rihBLxNHPHI.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rth9rihblxnhphi.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.556] GetFileType (hFile=0x398) returned 0x1 [0044.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.556] GetFileType (hFile=0x398) returned 0x1 [0044.556] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x168fc [0044.557] ReadFile (in: hFile=0x398, lpBuffer=0x3fea830, nNumberOfBytesToRead=0x168fc, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3fea830*, lpNumberOfBytesRead=0x10af320*=0x168fc, lpOverlapped=0x0) returned 1 [0044.576] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rTh9rihBLxNHPHI.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rTh9rihBLxNHPHI.bmp.ForgiveME", lpFilePart=0x0) returned 0x3b [0044.577] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rTh9rihBLxNHPHI.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rth9rihblxnhphi.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.578] GetFileType (hFile=0x398) returned 0x1 [0044.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.578] GetFileType (hFile=0x398) returned 0x1 [0044.578] WriteFile (in: hFile=0x398, lpBuffer=0x405b568*, nNumberOfBytesToWrite=0x16900, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x405b568*, lpNumberOfBytesWritten=0x10af310*=0x16900, lpOverlapped=0x0) returned 1 [0044.579] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rTh9rihBLxNHPHI.bmp", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rTh9rihBLxNHPHI.bmp", lpFilePart=0x0) returned 0x31 [0044.580] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\rTh9rihBLxNHPHI.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rth9rihblxnhphi.bmp")) returned 1 [0044.581] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\TKL9477z_W6f.png", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\TKL9477z_W6f.png", lpFilePart=0x0) returned 0x2e [0044.581] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\TKL9477z_W6f.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tkl9477z_w6f.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.582] GetFileType (hFile=0x398) returned 0x1 [0044.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.582] GetFileType (hFile=0x398) returned 0x1 [0044.582] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xab44 [0044.582] ReadFile (in: hFile=0x398, lpBuffer=0x2faf92c, nNumberOfBytesToRead=0xab44, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2faf92c*, lpNumberOfBytesRead=0x10af320*=0xab44, lpOverlapped=0x0) returned 1 [0044.597] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\TKL9477z_W6f.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\TKL9477z_W6f.png.ForgiveME", lpFilePart=0x0) returned 0x38 [0044.597] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\TKL9477z_W6f.png.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tkl9477z_w6f.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.598] GetFileType (hFile=0x398) returned 0x1 [0044.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.598] GetFileType (hFile=0x398) returned 0x1 [0044.598] WriteFile (in: hFile=0x398, lpBuffer=0x301c9bc*, nNumberOfBytesToWrite=0xab50, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x301c9bc*, lpNumberOfBytesWritten=0x10af310*=0xab50, lpOverlapped=0x0) returned 1 [0044.600] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\TKL9477z_W6f.png", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\TKL9477z_W6f.png", lpFilePart=0x0) returned 0x2e [0044.600] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\TKL9477z_W6f.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tkl9477z_w6f.png")) returned 1 [0044.601] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Tydyi381sT.pps", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Tydyi381sT.pps", lpFilePart=0x0) returned 0x2c [0044.601] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Tydyi381sT.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tydyi381st.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.602] GetFileType (hFile=0x398) returned 0x1 [0044.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.602] GetFileType (hFile=0x398) returned 0x1 [0044.602] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x1781a [0044.602] ReadFile (in: hFile=0x398, lpBuffer=0x4087528, nNumberOfBytesToRead=0x1781a, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x4087528*, lpNumberOfBytesRead=0x10af320*=0x1781a, lpOverlapped=0x0) returned 1 [0044.626] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Tydyi381sT.pps.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Tydyi381sT.pps.ForgiveME", lpFilePart=0x0) returned 0x36 [0044.626] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Tydyi381sT.pps.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tydyi381st.pps.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.627] GetFileType (hFile=0x398) returned 0x1 [0044.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.627] GetFileType (hFile=0x398) returned 0x1 [0044.627] WriteFile (in: hFile=0x398, lpBuffer=0x3df98d0*, nNumberOfBytesToWrite=0x17820, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3df98d0*, lpNumberOfBytesWritten=0x10af310*=0x17820, lpOverlapped=0x0) returned 1 [0044.629] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Tydyi381sT.pps", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Tydyi381sT.pps", lpFilePart=0x0) returned 0x2c [0044.629] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Tydyi381sT.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tydyi381st.pps")) returned 1 [0044.631] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ujVrUJfY.flv", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ujVrUJfY.flv", lpFilePart=0x0) returned 0x2a [0044.631] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ujVrUJfY.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ujvrujfy.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.631] GetFileType (hFile=0x398) returned 0x1 [0044.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.631] GetFileType (hFile=0x398) returned 0x1 [0044.631] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x18132 [0044.631] ReadFile (in: hFile=0x398, lpBuffer=0x3e11110, nNumberOfBytesToRead=0x18132, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3e11110*, lpNumberOfBytesRead=0x10af320*=0x18132, lpOverlapped=0x0) returned 1 [0044.649] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ujVrUJfY.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ujVrUJfY.flv.ForgiveME", lpFilePart=0x0) returned 0x34 [0044.649] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ujVrUJfY.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ujvrujfy.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.651] GetFileType (hFile=0x398) returned 0x1 [0044.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.651] GetFileType (hFile=0x398) returned 0x1 [0044.651] WriteFile (in: hFile=0x398, lpBuffer=0x3e89780*, nNumberOfBytesToWrite=0x18140, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3e89780*, lpNumberOfBytesWritten=0x10af310*=0x18140, lpOverlapped=0x0) returned 1 [0044.654] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ujVrUJfY.flv", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ujVrUJfY.flv", lpFilePart=0x0) returned 0x2a [0044.654] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ujVrUJfY.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ujvrujfy.flv")) returned 1 [0044.656] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ux9WveoSYImE35ldZ SV.xls", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ux9WveoSYImE35ldZ SV.xls", lpFilePart=0x0) returned 0x36 [0044.656] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ux9WveoSYImE35ldZ SV.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ux9wveosyime35ldz sv.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.656] GetFileType (hFile=0x398) returned 0x1 [0044.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.656] GetFileType (hFile=0x398) returned 0x1 [0044.656] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x112cd [0044.656] ReadFile (in: hFile=0x398, lpBuffer=0x2e542cc, nNumberOfBytesToRead=0x112cd, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e542cc*, lpNumberOfBytesRead=0x10af320*=0x112cd, lpOverlapped=0x0) returned 1 [0044.672] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ux9WveoSYImE35ldZ SV.xls.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ux9WveoSYImE35ldZ SV.xls.ForgiveME", lpFilePart=0x0) returned 0x40 [0044.672] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ux9WveoSYImE35ldZ SV.xls.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ux9wveosyime35ldz sv.xls.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.673] GetFileType (hFile=0x398) returned 0x1 [0044.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.673] GetFileType (hFile=0x398) returned 0x1 [0044.673] WriteFile (in: hFile=0x398, lpBuffer=0x2ed49f0*, nNumberOfBytesToWrite=0x112d0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2ed49f0*, lpNumberOfBytesWritten=0x10af310*=0x112d0, lpOverlapped=0x0) returned 1 [0044.675] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ux9WveoSYImE35ldZ SV.xls", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ux9WveoSYImE35ldZ SV.xls", lpFilePart=0x0) returned 0x36 [0044.675] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ux9WveoSYImE35ldZ SV.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ux9wveosyime35ldz sv.xls")) returned 1 [0044.677] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WjCsoy9NSK3WEc-jHGV.swf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WjCsoy9NSK3WEc-jHGV.swf", lpFilePart=0x0) returned 0x35 [0044.677] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WjCsoy9NSK3WEc-jHGV.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wjcsoy9nsk3wec-jhgv.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.677] GetFileType (hFile=0x398) returned 0x1 [0044.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.677] GetFileType (hFile=0x398) returned 0x1 [0044.677] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xc369 [0044.677] ReadFile (in: hFile=0x398, lpBuffer=0x2ee5fec, nNumberOfBytesToRead=0xc369, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ee5fec*, lpNumberOfBytesRead=0x10af320*=0xc369, lpOverlapped=0x0) returned 1 [0044.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WjCsoy9NSK3WEc-jHGV.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WjCsoy9NSK3WEc-jHGV.swf.ForgiveME", lpFilePart=0x0) returned 0x3f [0044.692] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WjCsoy9NSK3WEc-jHGV.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wjcsoy9nsk3wec-jhgv.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.693] GetFileType (hFile=0x398) returned 0x1 [0044.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.693] GetFileType (hFile=0x398) returned 0x1 [0044.693] WriteFile (in: hFile=0x398, lpBuffer=0x2f578ec*, nNumberOfBytesToWrite=0xc370, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f578ec*, lpNumberOfBytesWritten=0x10af310*=0xc370, lpOverlapped=0x0) returned 1 [0044.695] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WjCsoy9NSK3WEc-jHGV.swf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WjCsoy9NSK3WEc-jHGV.swf", lpFilePart=0x0) returned 0x35 [0044.695] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WjCsoy9NSK3WEc-jHGV.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wjcsoy9nsk3wec-jhgv.swf")) returned 1 [0044.696] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\YI3AzfSP2ixzlug.xlsx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\YI3AzfSP2ixzlug.xlsx", lpFilePart=0x0) returned 0x32 [0044.696] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\YI3AzfSP2ixzlug.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\yi3azfsp2ixzlug.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.696] GetFileType (hFile=0x398) returned 0x1 [0044.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.696] GetFileType (hFile=0x398) returned 0x1 [0044.696] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x7a5d [0044.696] ReadFile (in: hFile=0x398, lpBuffer=0x2f63f74, nNumberOfBytesToRead=0x7a5d, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f63f74*, lpNumberOfBytesRead=0x10af320*=0x7a5d, lpOverlapped=0x0) returned 1 [0044.712] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\YI3AzfSP2ixzlug.xlsx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\YI3AzfSP2ixzlug.xlsx.ForgiveME", lpFilePart=0x0) returned 0x3c [0044.712] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\YI3AzfSP2ixzlug.xlsx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\yi3azfsp2ixzlug.xlsx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.713] GetFileType (hFile=0x398) returned 0x1 [0044.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.713] GetFileType (hFile=0x398) returned 0x1 [0044.713] WriteFile (in: hFile=0x398, lpBuffer=0x2fd71ec*, nNumberOfBytesToWrite=0x7a60, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fd71ec*, lpNumberOfBytesWritten=0x10af310*=0x7a60, lpOverlapped=0x0) returned 1 [0044.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\YI3AzfSP2ixzlug.xlsx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\YI3AzfSP2ixzlug.xlsx", lpFilePart=0x0) returned 0x32 [0044.715] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\YI3AzfSP2ixzlug.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\yi3azfsp2ixzlug.xlsx")) returned 1 [0044.716] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx", lpFilePart=0x0) returned 0x22 [0044.716] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\", lpFilePart=0x0) returned 0x23 [0044.716] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145ca88 [0044.716] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.716] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0044.717] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0044.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0044.717] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx", lpFilePart=0x0) returned 0x22 [0044.717] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\", lpFilePart=0x0) returned 0x23 [0044.717] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c708 [0044.717] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.717] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.718] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.718] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.718] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.718] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.718] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0044.718] FindClose (in: hFindFile=0x145c708 | out: hFindFile=0x145c708) returned 1 [0044.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0044.718] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\0KKG5-_dyLtLLib.png", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\0KKG5-_dyLtLLib.png", lpFilePart=0x0) returned 0x36 [0044.718] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\0KKG5-_dyLtLLib.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\0kkg5-_dyltllib.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.718] GetFileType (hFile=0x398) returned 0x1 [0044.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0044.718] GetFileType (hFile=0x398) returned 0x1 [0044.718] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x3702 [0044.718] ReadFile (in: hFile=0x398, lpBuffer=0x2fe1d28, nNumberOfBytesToRead=0x3702, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2fe1d28*, lpNumberOfBytesRead=0x10af2e4*=0x3702, lpOverlapped=0x0) returned 1 [0044.734] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\0KKG5-_dyLtLLib.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\0KKG5-_dyLtLLib.png.ForgiveME", lpFilePart=0x0) returned 0x40 [0044.734] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\0KKG5-_dyLtLLib.png.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\0kkg5-_dyltllib.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.735] GetFileType (hFile=0x398) returned 0x1 [0044.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0044.735] GetFileType (hFile=0x398) returned 0x1 [0044.735] WriteFile (in: hFile=0x398, lpBuffer=0x2e442c0*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2e442c0*, lpNumberOfBytesWritten=0x10af2d4*=0x3710, lpOverlapped=0x0) returned 1 [0044.736] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\0KKG5-_dyLtLLib.png", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\0KKG5-_dyLtLLib.png", lpFilePart=0x0) returned 0x36 [0044.737] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\0KKG5-_dyLtLLib.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\0kkg5-_dyltllib.png")) returned 1 [0044.738] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\3OIfE3JyXSDyFI.odt", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\3OIfE3JyXSDyFI.odt", lpFilePart=0x0) returned 0x35 [0044.738] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\3OIfE3JyXSDyFI.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\3oife3jyxsdyfi.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.739] GetFileType (hFile=0x398) returned 0x1 [0044.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0044.739] GetFileType (hFile=0x398) returned 0x1 [0044.739] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x140ee [0044.739] ReadFile (in: hFile=0x398, lpBuffer=0x2e47ce8, nNumberOfBytesToRead=0x140ee, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2e47ce8*, lpNumberOfBytesRead=0x10af2e4*=0x140ee, lpOverlapped=0x0) returned 1 [0044.755] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\3OIfE3JyXSDyFI.odt.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\3OIfE3JyXSDyFI.odt.ForgiveME", lpFilePart=0x0) returned 0x3f [0044.755] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\3OIfE3JyXSDyFI.odt.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\3oife3jyxsdyfi.odt.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.756] GetFileType (hFile=0x398) returned 0x1 [0044.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0044.756] GetFileType (hFile=0x398) returned 0x1 [0044.756] WriteFile (in: hFile=0x398, lpBuffer=0x2ed0fc4*, nNumberOfBytesToWrite=0x140f0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2ed0fc4*, lpNumberOfBytesWritten=0x10af2d4*=0x140f0, lpOverlapped=0x0) returned 1 [0044.758] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\3OIfE3JyXSDyFI.odt", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\3OIfE3JyXSDyFI.odt", lpFilePart=0x0) returned 0x35 [0044.758] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\3OIfE3JyXSDyFI.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\3oife3jyxsdyfi.odt")) returned 1 [0044.760] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\a0be8GHMAJr.bmp", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\a0be8GHMAJr.bmp", lpFilePart=0x0) returned 0x32 [0044.760] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\a0be8GHMAJr.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\a0be8ghmajr.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.760] GetFileType (hFile=0x398) returned 0x1 [0044.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0044.760] GetFileType (hFile=0x398) returned 0x1 [0044.760] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x15ec0 [0044.761] ReadFile (in: hFile=0x398, lpBuffer=0x3f04740, nNumberOfBytesToRead=0x15ec0, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x3f04740*, lpNumberOfBytesRead=0x10af2e4*=0x15ec0, lpOverlapped=0x0) returned 1 [0044.780] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\a0be8GHMAJr.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\a0be8GHMAJr.bmp.ForgiveME", lpFilePart=0x0) returned 0x3c [0044.780] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\a0be8GHMAJr.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\a0be8ghmajr.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.781] GetFileType (hFile=0x398) returned 0x1 [0044.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0044.781] GetFileType (hFile=0x398) returned 0x1 [0044.781] WriteFile (in: hFile=0x398, lpBuffer=0x3f72180*, nNumberOfBytesToWrite=0x15ed0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x3f72180*, lpNumberOfBytesWritten=0x10af2d4*=0x15ed0, lpOverlapped=0x0) returned 1 [0044.783] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\a0be8GHMAJr.bmp", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\a0be8GHMAJr.bmp", lpFilePart=0x0) returned 0x32 [0044.783] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\a0be8GHMAJr.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\a0be8ghmajr.bmp")) returned 1 [0044.785] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\EG0aXcwV-hr.gif", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\EG0aXcwV-hr.gif", lpFilePart=0x0) returned 0x32 [0044.786] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\EG0aXcwV-hr.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\eg0axcwv-hr.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.786] GetFileType (hFile=0x398) returned 0x1 [0044.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0044.786] GetFileType (hFile=0x398) returned 0x1 [0044.786] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x6d50 [0044.786] ReadFile (in: hFile=0x398, lpBuffer=0x2f32554, nNumberOfBytesToRead=0x6d50, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2f32554*, lpNumberOfBytesRead=0x10af2e4*=0x6d50, lpOverlapped=0x0) returned 1 [0044.801] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\EG0aXcwV-hr.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\EG0aXcwV-hr.gif.ForgiveME", lpFilePart=0x0) returned 0x3c [0044.801] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\EG0aXcwV-hr.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\eg0axcwv-hr.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.802] GetFileType (hFile=0x398) returned 0x1 [0044.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0044.802] GetFileType (hFile=0x398) returned 0x1 [0044.802] WriteFile (in: hFile=0x398, lpBuffer=0x2fa16c8*, nNumberOfBytesToWrite=0x6d60, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2fa16c8*, lpNumberOfBytesWritten=0x10af2d4*=0x6d60, lpOverlapped=0x0) returned 1 [0044.803] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\EG0aXcwV-hr.gif", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\EG0aXcwV-hr.gif", lpFilePart=0x0) returned 0x32 [0044.803] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\EG0aXcwV-hr.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\eg0axcwv-hr.gif")) returned 1 [0044.805] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\jcIT590X8g5jj.mkv", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\jcIT590X8g5jj.mkv", lpFilePart=0x0) returned 0x34 [0044.805] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\jcIT590X8g5jj.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\jcit590x8g5jj.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.805] GetFileType (hFile=0x398) returned 0x1 [0044.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0044.805] GetFileType (hFile=0x398) returned 0x1 [0044.805] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x8575 [0044.805] ReadFile (in: hFile=0x398, lpBuffer=0x2fa8724, nNumberOfBytesToRead=0x8575, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2fa8724*, lpNumberOfBytesRead=0x10af2e4*=0x8575, lpOverlapped=0x0) returned 1 [0044.822] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\jcIT590X8g5jj.mkv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\jcIT590X8g5jj.mkv.ForgiveME", lpFilePart=0x0) returned 0x3e [0044.822] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\jcIT590X8g5jj.mkv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\jcit590x8g5jj.mkv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.823] GetFileType (hFile=0x398) returned 0x1 [0044.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0044.823] GetFileType (hFile=0x398) returned 0x1 [0044.824] WriteFile (in: hFile=0x398, lpBuffer=0x2e2b520*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2e2b520*, lpNumberOfBytesWritten=0x10af2d4*=0x8580, lpOverlapped=0x0) returned 1 [0044.825] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\jcIT590X8g5jj.mkv", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\jcIT590X8g5jj.mkv", lpFilePart=0x0) returned 0x34 [0044.826] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\jcIT590X8g5jj.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\jcit590x8g5jj.mkv")) returned 1 [0044.828] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\kTmaVKlwQCa2r.swf", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\kTmaVKlwQCa2r.swf", lpFilePart=0x0) returned 0x34 [0044.828] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\kTmaVKlwQCa2r.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\ktmavklwqca2r.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.828] GetFileType (hFile=0x398) returned 0x1 [0044.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0044.828] GetFileType (hFile=0x398) returned 0x1 [0044.828] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x15bd1 [0044.829] ReadFile (in: hFile=0x398, lpBuffer=0x3f88070, nNumberOfBytesToRead=0x15bd1, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x3f88070*, lpNumberOfBytesRead=0x10af2e4*=0x15bd1, lpOverlapped=0x0) returned 1 [0044.847] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\kTmaVKlwQCa2r.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\kTmaVKlwQCa2r.swf.ForgiveME", lpFilePart=0x0) returned 0x3e [0044.847] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\kTmaVKlwQCa2r.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\ktmavklwqca2r.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.849] GetFileType (hFile=0x398) returned 0x1 [0044.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0044.849] GetFileType (hFile=0x398) returned 0x1 [0044.849] WriteFile (in: hFile=0x398, lpBuffer=0x3ff4c00*, nNumberOfBytesToWrite=0x15be0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x3ff4c00*, lpNumberOfBytesWritten=0x10af2d4*=0x15be0, lpOverlapped=0x0) returned 1 [0044.851] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\kTmaVKlwQCa2r.swf", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\kTmaVKlwQCa2r.swf", lpFilePart=0x0) returned 0x34 [0044.851] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\kTmaVKlwQCa2r.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\ktmavklwqca2r.swf")) returned 1 [0044.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\LDq5roCjgTApRvRJvB.pps", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\LDq5roCjgTApRvRJvB.pps", lpFilePart=0x0) returned 0x39 [0044.852] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\LDq5roCjgTApRvRJvB.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\ldq5rocjgtaprvrjvb.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.853] GetFileType (hFile=0x398) returned 0x1 [0044.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0044.853] GetFileType (hFile=0x398) returned 0x1 [0044.853] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x18f81 [0044.853] ReadFile (in: hFile=0x398, lpBuffer=0x400a800, nNumberOfBytesToRead=0x18f81, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x400a800*, lpNumberOfBytesRead=0x10af2e4*=0x18f81, lpOverlapped=0x0) returned 1 [0044.870] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\LDq5roCjgTApRvRJvB.pps.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\LDq5roCjgTApRvRJvB.pps.ForgiveME", lpFilePart=0x0) returned 0x43 [0044.870] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\LDq5roCjgTApRvRJvB.pps.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\ldq5rocjgtaprvrjvb.pps.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.872] GetFileType (hFile=0x398) returned 0x1 [0044.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0044.872] GetFileType (hFile=0x398) returned 0x1 [0044.872] WriteFile (in: hFile=0x398, lpBuffer=0x4087600*, nNumberOfBytesToWrite=0x18f90, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x4087600*, lpNumberOfBytesWritten=0x10af2d4*=0x18f90, lpOverlapped=0x0) returned 1 [0044.873] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\LDq5roCjgTApRvRJvB.pps", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\LDq5roCjgTApRvRJvB.pps", lpFilePart=0x0) returned 0x39 [0044.873] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\LDq5roCjgTApRvRJvB.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\ldq5rocjgtaprvrjvb.pps")) returned 1 [0044.875] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\S3OcoaMO.m4a", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\S3OcoaMO.m4a", lpFilePart=0x0) returned 0x2f [0044.875] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\S3OcoaMO.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\s3ocoamo.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.875] GetFileType (hFile=0x398) returned 0x1 [0044.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0044.875] GetFileType (hFile=0x398) returned 0x1 [0044.876] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x5417 [0044.876] ReadFile (in: hFile=0x398, lpBuffer=0x2ece2e4, nNumberOfBytesToRead=0x5417, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2ece2e4*, lpNumberOfBytesRead=0x10af2e4*=0x5417, lpOverlapped=0x0) returned 1 [0044.890] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\S3OcoaMO.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\S3OcoaMO.m4a.ForgiveME", lpFilePart=0x0) returned 0x39 [0044.890] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\S3OcoaMO.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\s3ocoamo.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.891] GetFileType (hFile=0x398) returned 0x1 [0044.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0044.891] GetFileType (hFile=0x398) returned 0x1 [0044.891] WriteFile (in: hFile=0x398, lpBuffer=0x2f35614*, nNumberOfBytesToWrite=0x5420, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2f35614*, lpNumberOfBytesWritten=0x10af2d4*=0x5420, lpOverlapped=0x0) returned 1 [0044.893] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\S3OcoaMO.m4a", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\S3OcoaMO.m4a", lpFilePart=0x0) returned 0x2f [0044.893] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\S3OcoaMO.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\s3ocoamo.m4a")) returned 1 [0044.895] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\tLmYU7SeZ.mp3", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\tLmYU7SeZ.mp3", lpFilePart=0x0) returned 0x30 [0044.895] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\tLmYU7SeZ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\tlmyu7sez.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.895] GetFileType (hFile=0x398) returned 0x1 [0044.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0044.895] GetFileType (hFile=0x398) returned 0x1 [0044.895] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x1317a [0044.895] ReadFile (in: hFile=0x398, lpBuffer=0x2f3ad0c, nNumberOfBytesToRead=0x1317a, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2f3ad0c*, lpNumberOfBytesRead=0x10af2e4*=0x1317a, lpOverlapped=0x0) returned 1 [0044.912] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\tLmYU7SeZ.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\tLmYU7SeZ.mp3.ForgiveME", lpFilePart=0x0) returned 0x3a [0044.912] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\tLmYU7SeZ.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\tlmyu7sez.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.913] GetFileType (hFile=0x398) returned 0x1 [0044.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0044.913] GetFileType (hFile=0x398) returned 0x1 [0044.913] WriteFile (in: hFile=0x398, lpBuffer=0x2fc1034*, nNumberOfBytesToWrite=0x13180, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1034*, lpNumberOfBytesWritten=0x10af2d4*=0x13180, lpOverlapped=0x0) returned 1 [0044.915] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\tLmYU7SeZ.mp3", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\tLmYU7SeZ.mp3", lpFilePart=0x0) returned 0x30 [0044.915] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\tLmYU7SeZ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\tlmyu7sez.mp3")) returned 1 [0044.917] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\yLa77.m4a", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\yLa77.m4a", lpFilePart=0x0) returned 0x2c [0044.917] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\yLa77.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\yla77.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.917] GetFileType (hFile=0x398) returned 0x1 [0044.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0044.917] GetFileType (hFile=0x398) returned 0x1 [0044.917] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x20df [0044.917] ReadFile (in: hFile=0x398, lpBuffer=0x2fd4484, nNumberOfBytesToRead=0x20df, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2fd4484*, lpNumberOfBytesRead=0x10af2e4*=0x20df, lpOverlapped=0x0) returned 1 [0044.933] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\yLa77.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\yLa77.m4a.ForgiveME", lpFilePart=0x0) returned 0x36 [0044.933] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\yLa77.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\yla77.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.934] GetFileType (hFile=0x398) returned 0x1 [0044.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0044.934] GetFileType (hFile=0x398) returned 0x1 [0044.934] WriteFile (in: hFile=0x398, lpBuffer=0x2e3eabc*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2e3eabc*, lpNumberOfBytesWritten=0x10af2d4*=0x20e0, lpOverlapped=0x0) returned 1 [0044.935] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\yLa77.m4a", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\yLa77.m4a", lpFilePart=0x0) returned 0x2c [0044.935] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZKZx\\yLa77.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\zkzx\\yla77.m4a")) returned 1 [0044.937] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x10aee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0044.937] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\", nBufferLength=0x105, lpBuffer=0x10aee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpFilePart=0x0) returned 0x1c [0044.937] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*", lpFindFileData=0x10af0b0 | out: lpFindFileData=0x10af0b0) returned 0x145cb08 [0044.937] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.937] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.937] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.937] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.937] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.937] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.937] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.937] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 0 [0044.937] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0044.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af348) returned 1 [0044.938] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x10aee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0044.938] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\", nBufferLength=0x105, lpBuffer=0x10aee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\", lpFilePart=0x0) returned 0x1c [0044.938] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*", lpFindFileData=0x10af0b0 | out: lpFindFileData=0x10af0b0) returned 0x145cc08 [0044.938] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.938] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.938] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.938] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.938] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.938] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.938] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0044.938] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 0 [0044.938] FindClose (in: hFindFile=0x145cc08 | out: hFindFile=0x145cc08) returned 1 [0044.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af348) returned 1 [0044.938] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\w4xbjxkK.mp3", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\w4xbjxkK.mp3", lpFilePart=0x0) returned 0x28 [0044.938] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\w4xbjxkK.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\w4xbjxkk.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.939] GetFileType (hFile=0x398) returned 0x1 [0044.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0044.939] GetFileType (hFile=0x398) returned 0x1 [0044.939] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xe9e4 [0044.939] ReadFile (in: hFile=0x398, lpBuffer=0x2e42a50, nNumberOfBytesToRead=0xe9e4, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e42a50*, lpNumberOfBytesRead=0x10af320*=0xe9e4, lpOverlapped=0x0) returned 1 [0044.954] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\w4xbjxkK.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\w4xbjxkK.mp3.ForgiveME", lpFilePart=0x0) returned 0x32 [0044.955] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\w4xbjxkK.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\w4xbjxkk.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.955] GetFileType (hFile=0x398) returned 0x1 [0044.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0044.955] GetFileType (hFile=0x398) returned 0x1 [0044.955] WriteFile (in: hFile=0x398, lpBuffer=0x2ebb810*, nNumberOfBytesToWrite=0xe9f0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2ebb810*, lpNumberOfBytesWritten=0x10af310*=0xe9f0, lpOverlapped=0x0) returned 1 [0044.957] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\w4xbjxkK.mp3", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\w4xbjxkK.mp3", lpFilePart=0x0) returned 0x28 [0044.957] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\w4xbjxkK.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\w4xbjxkk.mp3")) returned 1 [0044.958] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC", lpFilePart=0x0) returned 0x24 [0044.958] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\", lpFilePart=0x0) returned 0x25 [0044.958] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145cc88 [0044.958] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0044.959] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0044.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0044.959] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC", lpFilePart=0x0) returned 0x24 [0044.959] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\", lpFilePart=0x0) returned 0x25 [0044.959] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145cb08 [0044.959] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.959] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0044.960] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0044.960] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0044.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0044.960] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\4xViYgP AP.mp3", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\4xViYgP AP.mp3", lpFilePart=0x0) returned 0x33 [0044.960] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\4xViYgP AP.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\4xviygp ap.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0044.960] GetFileType (hFile=0x398) returned 0x1 [0044.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0044.960] GetFileType (hFile=0x398) returned 0x1 [0044.960] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x1963 [0044.960] ReadFile (in: hFile=0x398, lpBuffer=0x2ecc980, nNumberOfBytesToRead=0x1963, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2ecc980*, lpNumberOfBytesRead=0x10af2e4*=0x1963, lpOverlapped=0x0) returned 1 [0045.002] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\4xViYgP AP.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\4xViYgP AP.mp3.ForgiveME", lpFilePart=0x0) returned 0x3d [0045.002] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\4xViYgP AP.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\4xviygp ap.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.003] GetFileType (hFile=0x398) returned 0x1 [0045.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0045.003] GetFileType (hFile=0x398) returned 0x1 [0045.003] WriteFile (in: hFile=0x398, lpBuffer=0x2f21748*, nNumberOfBytesToWrite=0x1970, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2f21748*, lpNumberOfBytesWritten=0x10af2d4*=0x1970, lpOverlapped=0x0) returned 1 [0045.004] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\4xViYgP AP.mp3", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\4xViYgP AP.mp3", lpFilePart=0x0) returned 0x33 [0045.004] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\4xViYgP AP.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\4xviygp ap.mp3")) returned 1 [0045.005] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\BlGhpVFW.m4a", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\BlGhpVFW.m4a", lpFilePart=0x0) returned 0x31 [0045.005] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\BlGhpVFW.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\blghpvfw.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.005] GetFileType (hFile=0x398) returned 0x1 [0045.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0045.005] GetFileType (hFile=0x398) returned 0x1 [0045.005] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x1361a [0045.005] ReadFile (in: hFile=0x398, lpBuffer=0x2f233a4, nNumberOfBytesToRead=0x1361a, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2f233a4*, lpNumberOfBytesRead=0x10af2e4*=0x1361a, lpOverlapped=0x0) returned 1 [0045.027] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\BlGhpVFW.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\BlGhpVFW.m4a.ForgiveME", lpFilePart=0x0) returned 0x3b [0045.027] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\BlGhpVFW.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\blghpvfw.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.028] GetFileType (hFile=0x398) returned 0x1 [0045.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0045.028] GetFileType (hFile=0x398) returned 0x1 [0045.029] WriteFile (in: hFile=0x398, lpBuffer=0x2faa4ac*, nNumberOfBytesToWrite=0x13620, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2faa4ac*, lpNumberOfBytesWritten=0x10af2d4*=0x13620, lpOverlapped=0x0) returned 1 [0045.030] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\BlGhpVFW.m4a", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\BlGhpVFW.m4a", lpFilePart=0x0) returned 0x31 [0045.030] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\BlGhpVFW.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\blghpvfw.m4a")) returned 1 [0045.032] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\fYRG.m4a", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\fYRG.m4a", lpFilePart=0x0) returned 0x2d [0045.032] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\fYRG.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\fyrg.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.032] GetFileType (hFile=0x398) returned 0x1 [0045.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0045.032] GetFileType (hFile=0x398) returned 0x1 [0045.032] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x3b98 [0045.032] ReadFile (in: hFile=0x398, lpBuffer=0x2fbdd9c, nNumberOfBytesToRead=0x3b98, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2fbdd9c*, lpNumberOfBytesRead=0x10af2e4*=0x3b98, lpOverlapped=0x0) returned 1 [0045.048] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\fYRG.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\fYRG.m4a.ForgiveME", lpFilePart=0x0) returned 0x37 [0045.048] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\fYRG.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\fyrg.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.049] GetFileType (hFile=0x398) returned 0x1 [0045.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0045.049] GetFileType (hFile=0x398) returned 0x1 [0045.049] WriteFile (in: hFile=0x398, lpBuffer=0x301d644*, nNumberOfBytesToWrite=0x3ba0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x301d644*, lpNumberOfBytesWritten=0x10af2d4*=0x3ba0, lpOverlapped=0x0) returned 1 [0045.050] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\fYRG.m4a", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\fYRG.m4a", lpFilePart=0x0) returned 0x2d [0045.050] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\fYRG.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\fyrg.m4a")) returned 1 [0045.051] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\G5IptOuLk0Yb.m4a", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\G5IptOuLk0Yb.m4a", lpFilePart=0x0) returned 0x35 [0045.051] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\G5IptOuLk0Yb.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\g5iptoulk0yb.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.051] GetFileType (hFile=0x398) returned 0x1 [0045.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0045.051] GetFileType (hFile=0x398) returned 0x1 [0045.051] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x6018 [0045.051] ReadFile (in: hFile=0x398, lpBuffer=0x30214bc, nNumberOfBytesToRead=0x6018, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x30214bc*, lpNumberOfBytesRead=0x10af2e4*=0x6018, lpOverlapped=0x0) returned 1 [0045.080] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\G5IptOuLk0Yb.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\G5IptOuLk0Yb.m4a.ForgiveME", lpFilePart=0x0) returned 0x3f [0045.080] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\G5IptOuLk0Yb.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\g5iptoulk0yb.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.080] GetFileType (hFile=0x398) returned 0x1 [0045.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0045.080] GetFileType (hFile=0x398) returned 0x1 [0045.080] WriteFile (in: hFile=0x398, lpBuffer=0x2e6b170*, nNumberOfBytesToWrite=0x6020, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2e6b170*, lpNumberOfBytesWritten=0x10af2d4*=0x6020, lpOverlapped=0x0) returned 1 [0045.081] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\G5IptOuLk0Yb.m4a", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\G5IptOuLk0Yb.m4a", lpFilePart=0x0) returned 0x35 [0045.081] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\G5IptOuLk0Yb.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\g5iptoulk0yb.m4a")) returned 1 [0045.083] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\ggVeB8Y.m4a", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\ggVeB8Y.m4a", lpFilePart=0x0) returned 0x30 [0045.083] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\ggVeB8Y.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\ggveb8y.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.083] GetFileType (hFile=0x398) returned 0x1 [0045.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0045.083] GetFileType (hFile=0x398) returned 0x1 [0045.083] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x272f [0045.083] ReadFile (in: hFile=0x398, lpBuffer=0x2e71484, nNumberOfBytesToRead=0x272f, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2e71484*, lpNumberOfBytesRead=0x10af2e4*=0x272f, lpOverlapped=0x0) returned 1 [0045.096] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\ggVeB8Y.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\ggVeB8Y.m4a.ForgiveME", lpFilePart=0x0) returned 0x3a [0045.096] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\ggVeB8Y.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\ggveb8y.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.097] GetFileType (hFile=0x398) returned 0x1 [0045.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0045.097] GetFileType (hFile=0x398) returned 0x1 [0045.097] WriteFile (in: hFile=0x398, lpBuffer=0x2eca864*, nNumberOfBytesToWrite=0x2730, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2eca864*, lpNumberOfBytesWritten=0x10af2d4*=0x2730, lpOverlapped=0x0) returned 1 [0045.098] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\ggVeB8Y.m4a", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\ggVeB8Y.m4a", lpFilePart=0x0) returned 0x30 [0045.098] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\ggVeB8Y.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\ggveb8y.m4a")) returned 1 [0045.099] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\Gx9alYUWzq.mp3", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\Gx9alYUWzq.mp3", lpFilePart=0x0) returned 0x33 [0045.099] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\Gx9alYUWzq.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\gx9alyuwzq.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.099] GetFileType (hFile=0x398) returned 0x1 [0045.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0045.099] GetFileType (hFile=0x398) returned 0x1 [0045.099] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x661d [0045.099] ReadFile (in: hFile=0x398, lpBuffer=0x2ecd278, nNumberOfBytesToRead=0x661d, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2ecd278*, lpNumberOfBytesRead=0x10af2e4*=0x661d, lpOverlapped=0x0) returned 1 [0045.113] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\Gx9alYUWzq.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\Gx9alYUWzq.mp3.ForgiveME", lpFilePart=0x0) returned 0x3d [0045.114] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\Gx9alYUWzq.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\gx9alyuwzq.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.114] GetFileType (hFile=0x398) returned 0x1 [0045.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0045.114] GetFileType (hFile=0x398) returned 0x1 [0045.114] WriteFile (in: hFile=0x398, lpBuffer=0x2f39fb0*, nNumberOfBytesToWrite=0x6620, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2f39fb0*, lpNumberOfBytesWritten=0x10af2d4*=0x6620, lpOverlapped=0x0) returned 1 [0045.115] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\Gx9alYUWzq.mp3", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\Gx9alYUWzq.mp3", lpFilePart=0x0) returned 0x33 [0045.115] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\Gx9alYUWzq.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\gx9alyuwzq.mp3")) returned 1 [0045.116] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\gzRkU9mQLTHPoK.mp3", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\gzRkU9mQLTHPoK.mp3", lpFilePart=0x0) returned 0x37 [0045.116] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\gzRkU9mQLTHPoK.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\gzrku9mqlthpok.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.116] GetFileType (hFile=0x398) returned 0x1 [0045.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0045.117] GetFileType (hFile=0x398) returned 0x1 [0045.117] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x829d [0045.117] ReadFile (in: hFile=0x398, lpBuffer=0x2f408d4, nNumberOfBytesToRead=0x829d, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2f408d4*, lpNumberOfBytesRead=0x10af2e4*=0x829d, lpOverlapped=0x0) returned 1 [0045.131] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\gzRkU9mQLTHPoK.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\gzRkU9mQLTHPoK.mp3.ForgiveME", lpFilePart=0x0) returned 0x41 [0045.131] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\gzRkU9mQLTHPoK.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\gzrku9mqlthpok.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.132] GetFileType (hFile=0x398) returned 0x1 [0045.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0045.132] GetFileType (hFile=0x398) returned 0x1 [0045.132] WriteFile (in: hFile=0x398, lpBuffer=0x2fb6494*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2fb6494*, lpNumberOfBytesWritten=0x10af2d4*=0x82a0, lpOverlapped=0x0) returned 1 [0045.133] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\gzRkU9mQLTHPoK.mp3", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\gzRkU9mQLTHPoK.mp3", lpFilePart=0x0) returned 0x37 [0045.133] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\gzRkU9mQLTHPoK.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\gzrku9mqlthpok.mp3")) returned 1 [0045.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY", lpFilePart=0x0) returned 0x34 [0045.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\", lpFilePart=0x0) returned 0x35 [0045.134] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c9c8 [0045.134] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.134] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.134] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.134] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.134] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.134] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.134] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.134] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0045.134] FindClose (in: hFindFile=0x145c9c8 | out: hFindFile=0x145c9c8) returned 1 [0045.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0045.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY", lpFilePart=0x0) returned 0x34 [0045.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\", lpFilePart=0x0) returned 0x35 [0045.134] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c9c8 [0045.135] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.135] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.135] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.135] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.135] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.135] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.135] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0045.135] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0045.135] FindClose (in: hFindFile=0x145c9c8 | out: hFindFile=0x145c9c8) returned 1 [0045.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0045.135] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\k_T 8.m4a", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\k_T 8.m4a", lpFilePart=0x0) returned 0x3e [0045.135] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\k_T 8.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\k_t 8.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.135] GetFileType (hFile=0x398) returned 0x1 [0045.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0045.135] GetFileType (hFile=0x398) returned 0x1 [0045.135] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x64d4 [0045.135] ReadFile (in: hFile=0x398, lpBuffer=0x2fc0d58, nNumberOfBytesToRead=0x64d4, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2fc0d58*, lpNumberOfBytesRead=0x10af2a8*=0x64d4, lpOverlapped=0x0) returned 1 [0045.184] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\k_T 8.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\k_T 8.m4a.ForgiveME", lpFilePart=0x0) returned 0x48 [0045.184] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\k_T 8.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\k_t 8.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.184] GetFileType (hFile=0x398) returned 0x1 [0045.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0045.184] GetFileType (hFile=0x398) returned 0x1 [0045.184] WriteFile (in: hFile=0x398, lpBuffer=0x2e404dc*, nNumberOfBytesToWrite=0x64e0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2e404dc*, lpNumberOfBytesWritten=0x10af298*=0x64e0, lpOverlapped=0x0) returned 1 [0045.185] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\k_T 8.m4a", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\k_T 8.m4a", lpFilePart=0x0) returned 0x3e [0045.185] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\k_T 8.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\k_t 8.m4a")) returned 1 [0045.187] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\oOsJ.mp3", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\oOsJ.mp3", lpFilePart=0x0) returned 0x3d [0045.187] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\oOsJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\oosj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.187] GetFileType (hFile=0x398) returned 0x1 [0045.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0045.187] GetFileType (hFile=0x398) returned 0x1 [0045.187] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x11cce [0045.187] ReadFile (in: hFile=0x398, lpBuffer=0x2e46cdc, nNumberOfBytesToRead=0x11cce, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2e46cdc*, lpNumberOfBytesRead=0x10af2a8*=0x11cce, lpOverlapped=0x0) returned 1 [0045.203] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\oOsJ.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\oOsJ.mp3.ForgiveME", lpFilePart=0x0) returned 0x47 [0045.203] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\oOsJ.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\oosj.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.203] GetFileType (hFile=0x398) returned 0x1 [0045.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0045.203] GetFileType (hFile=0x398) returned 0x1 [0045.203] WriteFile (in: hFile=0x398, lpBuffer=0x2ec9368*, nNumberOfBytesToWrite=0x11cd0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2ec9368*, lpNumberOfBytesWritten=0x10af298*=0x11cd0, lpOverlapped=0x0) returned 1 [0045.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\oOsJ.mp3", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\oOsJ.mp3", lpFilePart=0x0) returned 0x3d [0045.205] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\oOsJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\oosj.mp3")) returned 1 [0045.206] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\QOU0VF.m4a", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\QOU0VF.m4a", lpFilePart=0x0) returned 0x3f [0045.206] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\QOU0VF.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\qou0vf.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.206] GetFileType (hFile=0x398) returned 0x1 [0045.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0045.207] GetFileType (hFile=0x398) returned 0x1 [0045.207] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x12f5d [0045.207] ReadFile (in: hFile=0x398, lpBuffer=0x2edb358, nNumberOfBytesToRead=0x12f5d, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2edb358*, lpNumberOfBytesRead=0x10af2a8*=0x12f5d, lpOverlapped=0x0) returned 1 [0045.223] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\QOU0VF.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\QOU0VF.m4a.ForgiveME", lpFilePart=0x0) returned 0x49 [0045.223] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\QOU0VF.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\qou0vf.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.223] GetFileType (hFile=0x398) returned 0x1 [0045.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0045.223] GetFileType (hFile=0x398) returned 0x1 [0045.223] WriteFile (in: hFile=0x398, lpBuffer=0x2f6103c*, nNumberOfBytesToWrite=0x12f60, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2f6103c*, lpNumberOfBytesWritten=0x10af298*=0x12f60, lpOverlapped=0x0) returned 1 [0045.227] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\QOU0VF.m4a", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\QOU0VF.m4a", lpFilePart=0x0) returned 0x3f [0045.227] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\QOU0VF.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\qou0vf.m4a")) returned 1 [0045.228] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj", lpFilePart=0x0) returned 0x3d [0045.228] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\", lpFilePart=0x0) returned 0x3e [0045.228] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cd48 [0045.228] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.228] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.228] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.228] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0045.229] FindClose (in: hFindFile=0x145cd48 | out: hFindFile=0x145cd48) returned 1 [0045.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0045.229] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj", lpFilePart=0x0) returned 0x3d [0045.229] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\", lpFilePart=0x0) returned 0x3e [0045.229] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145ca88 [0045.229] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.229] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.229] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.229] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0045.229] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0045.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0045.229] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\1gkubuOd.m4a", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\1gkubuOd.m4a", lpFilePart=0x0) returned 0x4a [0045.229] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\1gkubuOd.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\bpf3zzpj\\1gkubuod.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.229] GetFileType (hFile=0x398) returned 0x1 [0045.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0045.229] GetFileType (hFile=0x398) returned 0x1 [0045.229] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x8115 [0045.229] ReadFile (in: hFile=0x398, lpBuffer=0x2f75e08, nNumberOfBytesToRead=0x8115, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2f75e08*, lpNumberOfBytesRead=0x10af26c*=0x8115, lpOverlapped=0x0) returned 1 [0045.244] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\1gkubuOd.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\1gkubuOd.m4a.ForgiveME", lpFilePart=0x0) returned 0x54 [0045.244] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\1gkubuOd.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\bpf3zzpj\\1gkubuod.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.245] GetFileType (hFile=0x398) returned 0x1 [0045.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0045.245] GetFileType (hFile=0x398) returned 0x1 [0045.245] WriteFile (in: hFile=0x398, lpBuffer=0x2feb270*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2feb270*, lpNumberOfBytesWritten=0x10af25c*=0x8120, lpOverlapped=0x0) returned 1 [0045.246] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\1gkubuOd.m4a", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\1gkubuOd.m4a", lpFilePart=0x0) returned 0x4a [0045.246] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\1gkubuOd.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\bpf3zzpj\\1gkubuod.m4a")) returned 1 [0045.247] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\niRPdsG WED6kqVJAVlt.m4a", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\niRPdsG WED6kqVJAVlt.m4a", lpFilePart=0x0) returned 0x56 [0045.247] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\niRPdsG WED6kqVJAVlt.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\bpf3zzpj\\nirpdsg wed6kqvjavlt.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.247] GetFileType (hFile=0x398) returned 0x1 [0045.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0045.247] GetFileType (hFile=0x398) returned 0x1 [0045.247] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x1d8c [0045.247] ReadFile (in: hFile=0x398, lpBuffer=0x2ff373c, nNumberOfBytesToRead=0x1d8c, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2ff373c*, lpNumberOfBytesRead=0x10af26c*=0x1d8c, lpOverlapped=0x0) returned 1 [0045.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\niRPdsG WED6kqVJAVlt.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\niRPdsG WED6kqVJAVlt.m4a.ForgiveME", lpFilePart=0x0) returned 0x60 [0045.263] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\niRPdsG WED6kqVJAVlt.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\bpf3zzpj\\nirpdsg wed6kqvjavlt.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.265] GetFileType (hFile=0x398) returned 0x1 [0045.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0045.265] GetFileType (hFile=0x398) returned 0x1 [0045.265] WriteFile (in: hFile=0x398, lpBuffer=0x2e58a58*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2e58a58*, lpNumberOfBytesWritten=0x10af25c*=0x1d90, lpOverlapped=0x0) returned 1 [0045.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\niRPdsG WED6kqVJAVlt.m4a", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\niRPdsG WED6kqVJAVlt.m4a", lpFilePart=0x0) returned 0x56 [0045.265] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\bpF3ZZPj\\niRPdsG WED6kqVJAVlt.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\bpf3zzpj\\nirpdsg wed6kqvjavlt.m4a")) returned 1 [0045.266] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ", lpFilePart=0x0) returned 0x3e [0045.266] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\", lpFilePart=0x0) returned 0x3f [0045.267] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cdc8 [0045.267] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.267] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.267] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.267] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0045.267] FindClose (in: hFindFile=0x145cdc8 | out: hFindFile=0x145cdc8) returned 1 [0045.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0045.267] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ", lpFilePart=0x0) returned 0x3e [0045.267] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\", lpFilePart=0x0) returned 0x3f [0045.267] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cd08 [0045.267] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.267] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.267] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.267] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0045.267] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0045.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0045.267] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\JymdOLTsgEfF6EKJCZf6.mp3", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\JymdOLTsgEfF6EKJCZf6.mp3", lpFilePart=0x0) returned 0x57 [0045.268] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\JymdOLTsgEfF6EKJCZf6.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lcn6npeyq\\jymdoltsgeff6ekjczf6.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.268] GetFileType (hFile=0x398) returned 0x1 [0045.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0045.268] GetFileType (hFile=0x398) returned 0x1 [0045.268] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0xe624 [0045.268] ReadFile (in: hFile=0x398, lpBuffer=0x2e5c7d4, nNumberOfBytesToRead=0xe624, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2e5c7d4*, lpNumberOfBytesRead=0x10af26c*=0xe624, lpOverlapped=0x0) returned 1 [0045.286] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\JymdOLTsgEfF6EKJCZf6.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\JymdOLTsgEfF6EKJCZf6.mp3.ForgiveME", lpFilePart=0x0) returned 0x61 [0045.286] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\JymdOLTsgEfF6EKJCZf6.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lcn6npeyq\\jymdoltsgeff6ekjczf6.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.287] GetFileType (hFile=0x398) returned 0x1 [0045.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0045.288] GetFileType (hFile=0x398) returned 0x1 [0045.288] WriteFile (in: hFile=0x398, lpBuffer=0x2ed4ab0*, nNumberOfBytesToWrite=0xe630, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2ed4ab0*, lpNumberOfBytesWritten=0x10af25c*=0xe630, lpOverlapped=0x0) returned 1 [0045.289] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\JymdOLTsgEfF6EKJCZf6.mp3", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\JymdOLTsgEfF6EKJCZf6.mp3", lpFilePart=0x0) returned 0x57 [0045.289] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\JymdOLTsgEfF6EKJCZf6.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lcn6npeyq\\jymdoltsgeff6ekjczf6.mp3")) returned 1 [0045.290] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\tTtDXoPeBaEVZd.m4a", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\tTtDXoPeBaEVZd.m4a", lpFilePart=0x0) returned 0x51 [0045.290] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\tTtDXoPeBaEVZd.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lcn6npeyq\\tttdxopebaevzd.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.290] GetFileType (hFile=0x398) returned 0x1 [0045.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0045.290] GetFileType (hFile=0x398) returned 0x1 [0045.290] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x15d62 [0045.290] ReadFile (in: hFile=0x398, lpBuffer=0x3e5fd90, nNumberOfBytesToRead=0x15d62, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x3e5fd90*, lpNumberOfBytesRead=0x10af26c*=0x15d62, lpOverlapped=0x0) returned 1 [0045.310] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\tTtDXoPeBaEVZd.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\tTtDXoPeBaEVZd.m4a.ForgiveME", lpFilePart=0x0) returned 0x5b [0045.310] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\tTtDXoPeBaEVZd.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lcn6npeyq\\tttdxopebaevzd.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.311] GetFileType (hFile=0x398) returned 0x1 [0045.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0045.311] GetFileType (hFile=0x398) returned 0x1 [0045.311] WriteFile (in: hFile=0x398, lpBuffer=0x3ecd0f0*, nNumberOfBytesToWrite=0x15d70, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x3ecd0f0*, lpNumberOfBytesWritten=0x10af25c*=0x15d70, lpOverlapped=0x0) returned 1 [0045.312] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\tTtDXoPeBaEVZd.m4a", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\tTtDXoPeBaEVZd.m4a", lpFilePart=0x0) returned 0x51 [0045.313] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lcn6NPeyQ\\tTtDXoPeBaEVZd.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lcn6npeyq\\tttdxopebaevzd.m4a")) returned 1 [0045.314] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3", lpFilePart=0x0) returned 0x39 [0045.314] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\", lpFilePart=0x0) returned 0x3a [0045.314] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cdc8 [0045.314] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.314] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.314] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.314] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.314] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0045.314] FindClose (in: hFindFile=0x145cdc8 | out: hFindFile=0x145cdc8) returned 1 [0045.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0045.315] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3", lpFilePart=0x0) returned 0x39 [0045.315] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\", lpFilePart=0x0) returned 0x3a [0045.315] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb08 [0045.315] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.315] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.315] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.315] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0045.315] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0045.315] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0045.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0045.316] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\-pP6wHj6F9fqzpkS.mp3", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\-pP6wHj6F9fqzpkS.mp3", lpFilePart=0x0) returned 0x4e [0045.316] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\-pP6wHj6F9fqzpkS.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\-pp6whj6f9fqzpks.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.316] GetFileType (hFile=0x398) returned 0x1 [0045.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0045.316] GetFileType (hFile=0x398) returned 0x1 [0045.316] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0xea1f [0045.316] ReadFile (in: hFile=0x398, lpBuffer=0x2f3255c, nNumberOfBytesToRead=0xea1f, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2f3255c*, lpNumberOfBytesRead=0x10af26c*=0xea1f, lpOverlapped=0x0) returned 1 [0045.332] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\-pP6wHj6F9fqzpkS.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\-pP6wHj6F9fqzpkS.mp3.ForgiveME", lpFilePart=0x0) returned 0x58 [0045.332] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\-pP6wHj6F9fqzpkS.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\-pp6whj6f9fqzpks.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.332] GetFileType (hFile=0x398) returned 0x1 [0045.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0045.332] GetFileType (hFile=0x398) returned 0x1 [0045.332] WriteFile (in: hFile=0x398, lpBuffer=0x2fab2a0*, nNumberOfBytesToWrite=0xea20, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2fab2a0*, lpNumberOfBytesWritten=0x10af25c*=0xea20, lpOverlapped=0x0) returned 1 [0045.334] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\-pP6wHj6F9fqzpkS.mp3", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\-pP6wHj6F9fqzpkS.mp3", lpFilePart=0x0) returned 0x4e [0045.334] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\-pP6wHj6F9fqzpkS.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\-pp6whj6f9fqzpks.mp3")) returned 1 [0045.335] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\dR7lwIGs0Z.mp3", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\dR7lwIGs0Z.mp3", lpFilePart=0x0) returned 0x48 [0045.335] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\dR7lwIGs0Z.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\dr7lwigs0z.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.335] GetFileType (hFile=0x398) returned 0x1 [0045.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0045.335] GetFileType (hFile=0x398) returned 0x1 [0045.335] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0xdd62 [0045.335] ReadFile (in: hFile=0x398, lpBuffer=0x2fba05c, nNumberOfBytesToRead=0xdd62, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2fba05c*, lpNumberOfBytesRead=0x10af26c*=0xdd62, lpOverlapped=0x0) returned 1 [0045.353] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\dR7lwIGs0Z.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\dR7lwIGs0Z.mp3.ForgiveME", lpFilePart=0x0) returned 0x52 [0045.353] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\dR7lwIGs0Z.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\dr7lwigs0z.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.353] GetFileType (hFile=0x398) returned 0x1 [0045.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0045.353] GetFileType (hFile=0x398) returned 0x1 [0045.354] WriteFile (in: hFile=0x398, lpBuffer=0x2e32af0*, nNumberOfBytesToWrite=0xdd70, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2e32af0*, lpNumberOfBytesWritten=0x10af25c*=0xdd70, lpOverlapped=0x0) returned 1 [0045.355] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\dR7lwIGs0Z.mp3", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\dR7lwIGs0Z.mp3", lpFilePart=0x0) returned 0x48 [0045.355] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\dR7lwIGs0Z.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\dr7lwigs0z.mp3")) returned 1 [0045.356] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI", lpFilePart=0x0) returned 0x4d [0045.356] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\", lpFilePart=0x0) returned 0x4e [0045.356] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cd48 [0045.356] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0045.356] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0045.356] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0045.356] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0045.356] FindClose (in: hFindFile=0x145cd48 | out: hFindFile=0x145cd48) returned 1 [0045.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0045.356] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI", lpFilePart=0x0) returned 0x4d [0045.357] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\", lpFilePart=0x0) returned 0x4e [0045.357] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cd08 [0045.357] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0045.357] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0045.357] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0045.357] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0045.357] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0045.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0045.357] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE", lpFilePart=0x0) returned 0x52 [0045.357] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\", lpFilePart=0x0) returned 0x53 [0045.357] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\*", lpFindFileData=0x10aef84 | out: lpFindFileData=0x10aef84) returned 0x145c808 [0045.357] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0045.357] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0045.357] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0045.357] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 0 [0045.357] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0045.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0045.357] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE", lpFilePart=0x0) returned 0x52 [0045.358] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\", lpFilePart=0x0) returned 0x53 [0045.358] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\*", lpFindFileData=0x10aef84 | out: lpFindFileData=0x10aef84) returned 0x145c808 [0045.358] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0045.358] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0045.358] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0045.358] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 0 [0045.358] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0045.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0045.358] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc", nBufferLength=0x105, lpBuffer=0x10aed28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc", lpFilePart=0x0) returned 0x67 [0045.358] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\", nBufferLength=0x105, lpBuffer=0x10aecfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\", lpFilePart=0x0) returned 0x68 [0045.358] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\*", lpFindFileData=0x10aef48 | out: lpFindFileData=0x10aef48) returned 0x145c808 [0045.358] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 1 [0045.358] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 1 [0045.358] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 1 [0045.358] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 1 [0045.358] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 0 [0045.358] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0045.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1e0) returned 1 [0045.359] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc", nBufferLength=0x105, lpBuffer=0x10aed28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc", lpFilePart=0x0) returned 0x67 [0045.359] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\", nBufferLength=0x105, lpBuffer=0x10aecfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\", lpFilePart=0x0) returned 0x68 [0045.359] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\*", lpFindFileData=0x10aef48 | out: lpFindFileData=0x10aef48) returned 0x145cd08 [0045.359] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 1 [0045.359] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 1 [0045.359] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 1 [0045.359] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 1 [0045.359] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 0 [0045.359] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0045.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1e0) returned 1 [0045.359] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\iZK-yr.m4a", nBufferLength=0x105, lpBuffer=0x10aec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\iZK-yr.m4a", lpFilePart=0x0) returned 0x72 [0045.359] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\iZK-yr.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\pubzdyejdowwphisqli\\m_de\\nix 6-walvsx9oismnhc\\izk-yr.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.359] GetFileType (hFile=0x398) returned 0x1 [0045.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af100) returned 1 [0045.359] GetFileType (hFile=0x398) returned 0x1 [0045.359] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af20c | out: lpFileSizeHigh=0x10af20c*=0x0) returned 0x150be [0045.360] ReadFile (in: hFile=0x398, lpBuffer=0x3f1bda0, nNumberOfBytesToRead=0x150be, lpNumberOfBytesRead=0x10af1b8, lpOverlapped=0x0 | out: lpBuffer=0x3f1bda0*, lpNumberOfBytesRead=0x10af1b8*=0x150be, lpOverlapped=0x0) returned 1 [0045.380] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\iZK-yr.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aebf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\iZK-yr.m4a.ForgiveME", lpFilePart=0x0) returned 0x7c [0045.380] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\iZK-yr.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\pubzdyejdowwphisqli\\m_de\\nix 6-walvsx9oismnhc\\izk-yr.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.381] GetFileType (hFile=0x398) returned 0x1 [0045.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af0e8) returned 1 [0045.381] GetFileType (hFile=0x398) returned 0x1 [0045.381] WriteFile (in: hFile=0x398, lpBuffer=0x3f851a0*, nNumberOfBytesToWrite=0x150c0, lpNumberOfBytesWritten=0x10af1a8, lpOverlapped=0x0 | out: lpBuffer=0x3f851a0*, lpNumberOfBytesWritten=0x10af1a8*=0x150c0, lpOverlapped=0x0) returned 1 [0045.383] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\iZK-yr.m4a", nBufferLength=0x105, lpBuffer=0x10aed58, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\iZK-yr.m4a", lpFilePart=0x0) returned 0x72 [0045.383] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\iZK-yr.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\pubzdyejdowwphisqli\\m_de\\nix 6-walvsx9oismnhc\\izk-yr.m4a")) returned 1 [0045.385] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\RGDQGWbIKXeY0JuzB.m4a", nBufferLength=0x105, lpBuffer=0x10aec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\RGDQGWbIKXeY0JuzB.m4a", lpFilePart=0x0) returned 0x7d [0045.385] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\RGDQGWbIKXeY0JuzB.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\pubzdyejdowwphisqli\\m_de\\nix 6-walvsx9oismnhc\\rgdqgwbikxey0juzb.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.385] GetFileType (hFile=0x398) returned 0x1 [0045.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af100) returned 1 [0045.385] GetFileType (hFile=0x398) returned 0x1 [0045.385] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af20c | out: lpFileSizeHigh=0x10af20c*=0x0) returned 0x75b1 [0045.385] ReadFile (in: hFile=0x398, lpBuffer=0x2e94be4, nNumberOfBytesToRead=0x75b1, lpNumberOfBytesRead=0x10af1b8, lpOverlapped=0x0 | out: lpBuffer=0x2e94be4*, lpNumberOfBytesRead=0x10af1b8*=0x75b1, lpOverlapped=0x0) returned 1 [0045.400] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\RGDQGWbIKXeY0JuzB.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aebf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\RGDQGWbIKXeY0JuzB.m4a.ForgiveME", lpFilePart=0x0) returned 0x87 [0045.400] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\RGDQGWbIKXeY0JuzB.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\pubzdyejdowwphisqli\\m_de\\nix 6-walvsx9oismnhc\\rgdqgwbikxey0juzb.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.400] GetFileType (hFile=0x398) returned 0x1 [0045.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af0e8) returned 1 [0045.400] GetFileType (hFile=0x398) returned 0x1 [0045.401] WriteFile (in: hFile=0x398, lpBuffer=0x2f067d0*, nNumberOfBytesToWrite=0x75c0, lpNumberOfBytesWritten=0x10af1a8, lpOverlapped=0x0 | out: lpBuffer=0x2f067d0*, lpNumberOfBytesWritten=0x10af1a8*=0x75c0, lpOverlapped=0x0) returned 1 [0045.402] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\RGDQGWbIKXeY0JuzB.m4a", nBufferLength=0x105, lpBuffer=0x10aed58, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\RGDQGWbIKXeY0JuzB.m4a", lpFilePart=0x0) returned 0x7d [0045.402] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\RGDQGWbIKXeY0JuzB.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\pubzdyejdowwphisqli\\m_de\\nix 6-walvsx9oismnhc\\rgdqgwbikxey0juzb.m4a")) returned 1 [0045.403] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\YIWVXn.mp3", nBufferLength=0x105, lpBuffer=0x10aec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\YIWVXn.mp3", lpFilePart=0x0) returned 0x72 [0045.403] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\YIWVXn.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\pubzdyejdowwphisqli\\m_de\\nix 6-walvsx9oismnhc\\yiwvxn.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.403] GetFileType (hFile=0x398) returned 0x1 [0045.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af100) returned 1 [0045.403] GetFileType (hFile=0x398) returned 0x1 [0045.403] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af20c | out: lpFileSizeHigh=0x10af20c*=0x0) returned 0x15a62 [0045.404] ReadFile (in: hFile=0x398, lpBuffer=0x3f9a280, nNumberOfBytesToRead=0x15a62, lpNumberOfBytesRead=0x10af1b8, lpOverlapped=0x0 | out: lpBuffer=0x3f9a280*, lpNumberOfBytesRead=0x10af1b8*=0x15a62, lpOverlapped=0x0) returned 1 [0045.423] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\YIWVXn.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aebf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\YIWVXn.mp3.ForgiveME", lpFilePart=0x0) returned 0x7c [0045.423] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\YIWVXn.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\pubzdyejdowwphisqli\\m_de\\nix 6-walvsx9oismnhc\\yiwvxn.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.424] GetFileType (hFile=0x398) returned 0x1 [0045.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af0e8) returned 1 [0045.424] GetFileType (hFile=0x398) returned 0x1 [0045.424] WriteFile (in: hFile=0x398, lpBuffer=0x40066e0*, nNumberOfBytesToWrite=0x15a70, lpNumberOfBytesWritten=0x10af1a8, lpOverlapped=0x0 | out: lpBuffer=0x40066e0*, lpNumberOfBytesWritten=0x10af1a8*=0x15a70, lpOverlapped=0x0) returned 1 [0045.426] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\YIWVXn.mp3", nBufferLength=0x105, lpBuffer=0x10aed58, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\YIWVXn.mp3", lpFilePart=0x0) returned 0x72 [0045.426] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\-adZkLBC\\P1mSoB7ZwTBS ZY\\lYS3\\PuBzdyEjdowWPHisqLI\\m_dE\\niX 6-wALvSX9OIsmnHc\\YIWVXn.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\-adzklbc\\p1msob7zwtbs zy\\lys3\\pubzdyejdowwphisqli\\m_de\\nix 6-walvsx9oismnhc\\yiwvxn.mp3")) returned 1 [0045.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x10aee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0045.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", nBufferLength=0x105, lpBuffer=0x10aee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpFilePart=0x0) returned 0x1f [0045.427] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*", lpFindFileData=0x10af0b0 | out: lpFindFileData=0x10af0b0) returned 0x145c948 [0045.427] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.427] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 0 [0045.428] FindClose (in: hFindFile=0x145c948 | out: hFindFile=0x145c948) returned 1 [0045.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af348) returned 1 [0045.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x10aee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0045.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", nBufferLength=0x105, lpBuffer=0x10aee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\", lpFilePart=0x0) returned 0x1f [0045.428] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*", lpFindFileData=0x10af0b0 | out: lpFindFileData=0x10af0b0) returned 0x145c8c8 [0045.428] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.428] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.429] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.429] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.429] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.429] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0045.429] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 0 [0045.429] FindClose (in: hFindFile=0x145c8c8 | out: hFindFile=0x145c8c8) returned 1 [0045.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af348) returned 1 [0045.429] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8hj-wT Vmm6RSkDVjsF.gif", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8hj-wT Vmm6RSkDVjsF.gif", lpFilePart=0x0) returned 0x36 [0045.429] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8hj-wT Vmm6RSkDVjsF.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\8hj-wt vmm6rskdvjsf.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.429] GetFileType (hFile=0x398) returned 0x1 [0045.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0045.429] GetFileType (hFile=0x398) returned 0x1 [0045.429] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x136f9 [0045.429] ReadFile (in: hFile=0x398, lpBuffer=0x2f5e0e8, nNumberOfBytesToRead=0x136f9, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f5e0e8*, lpNumberOfBytesRead=0x10af320*=0x136f9, lpOverlapped=0x0) returned 1 [0045.446] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8hj-wT Vmm6RSkDVjsF.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8hj-wT Vmm6RSkDVjsF.gif.ForgiveME", lpFilePart=0x0) returned 0x40 [0045.446] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8hj-wT Vmm6RSkDVjsF.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\8hj-wt vmm6rskdvjsf.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.446] GetFileType (hFile=0x398) returned 0x1 [0045.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0045.446] GetFileType (hFile=0x398) returned 0x1 [0045.446] WriteFile (in: hFile=0x398, lpBuffer=0x2fe549c*, nNumberOfBytesToWrite=0x13700, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fe549c*, lpNumberOfBytesWritten=0x10af310*=0x13700, lpOverlapped=0x0) returned 1 [0045.448] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8hj-wT Vmm6RSkDVjsF.gif", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8hj-wT Vmm6RSkDVjsF.gif", lpFilePart=0x0) returned 0x36 [0045.448] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8hj-wT Vmm6RSkDVjsF.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\8hj-wt vmm6rskdvjsf.gif")) returned 1 [0045.449] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8IwuY0yq7.jpg", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8IwuY0yq7.jpg", lpFilePart=0x0) returned 0x2c [0045.449] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8IwuY0yq7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\8iwuy0yq7.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.449] GetFileType (hFile=0x398) returned 0x1 [0045.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0045.449] GetFileType (hFile=0x398) returned 0x1 [0045.449] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x9460 [0045.449] ReadFile (in: hFile=0x398, lpBuffer=0x2ff8ea0, nNumberOfBytesToRead=0x9460, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ff8ea0*, lpNumberOfBytesRead=0x10af320*=0x9460, lpOverlapped=0x0) returned 1 [0045.465] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8IwuY0yq7.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8IwuY0yq7.jpg.ForgiveME", lpFilePart=0x0) returned 0x36 [0045.466] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8IwuY0yq7.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\8iwuy0yq7.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.466] GetFileType (hFile=0x398) returned 0x1 [0045.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0045.466] GetFileType (hFile=0x398) returned 0x1 [0045.466] WriteFile (in: hFile=0x398, lpBuffer=0x2e7e04c*, nNumberOfBytesToWrite=0x9470, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e7e04c*, lpNumberOfBytesWritten=0x10af310*=0x9470, lpOverlapped=0x0) returned 1 [0045.467] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8IwuY0yq7.jpg", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8IwuY0yq7.jpg", lpFilePart=0x0) returned 0x2c [0045.467] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\8IwuY0yq7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\8iwuy0yq7.jpg")) returned 1 [0045.469] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rfSBEsMiOiNX8geU.bmp", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rfSBEsMiOiNX8geU.bmp", lpFilePart=0x0) returned 0x33 [0045.469] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rfSBEsMiOiNX8geU.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\rfsbesmioinx8geu.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.469] GetFileType (hFile=0x398) returned 0x1 [0045.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0045.469] GetFileType (hFile=0x398) returned 0x1 [0045.469] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x95f1 [0045.469] ReadFile (in: hFile=0x398, lpBuffer=0x2e877f4, nNumberOfBytesToRead=0x95f1, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e877f4*, lpNumberOfBytesRead=0x10af320*=0x95f1, lpOverlapped=0x0) returned 1 [0045.483] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rfSBEsMiOiNX8geU.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rfSBEsMiOiNX8geU.bmp.ForgiveME", lpFilePart=0x0) returned 0x3d [0045.483] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rfSBEsMiOiNX8geU.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\rfsbesmioinx8geu.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.484] GetFileType (hFile=0x398) returned 0x1 [0045.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0045.484] GetFileType (hFile=0x398) returned 0x1 [0045.484] WriteFile (in: hFile=0x398, lpBuffer=0x2f035e8*, nNumberOfBytesToWrite=0x9600, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f035e8*, lpNumberOfBytesWritten=0x10af310*=0x9600, lpOverlapped=0x0) returned 1 [0045.485] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rfSBEsMiOiNX8geU.bmp", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rfSBEsMiOiNX8geU.bmp", lpFilePart=0x0) returned 0x33 [0045.485] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\rfSBEsMiOiNX8geU.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\rfsbesmioinx8geu.bmp")) returned 1 [0045.486] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\V2XpokArQEslR4XPpUN.jpg", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\V2XpokArQEslR4XPpUN.jpg", lpFilePart=0x0) returned 0x36 [0045.486] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\V2XpokArQEslR4XPpUN.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\v2xpokarqeslr4xppun.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.487] GetFileType (hFile=0x398) returned 0x1 [0045.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0045.487] GetFileType (hFile=0x398) returned 0x1 [0045.487] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xe084 [0045.487] ReadFile (in: hFile=0x398, lpBuffer=0x2f0cf00, nNumberOfBytesToRead=0xe084, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f0cf00*, lpNumberOfBytesRead=0x10af320*=0xe084, lpOverlapped=0x0) returned 1 [0045.595] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\V2XpokArQEslR4XPpUN.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\V2XpokArQEslR4XPpUN.jpg.ForgiveME", lpFilePart=0x0) returned 0x40 [0045.595] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\V2XpokArQEslR4XPpUN.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\v2xpokarqeslr4xppun.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.595] GetFileType (hFile=0x398) returned 0x1 [0045.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0045.595] GetFileType (hFile=0x398) returned 0x1 [0045.595] WriteFile (in: hFile=0x398, lpBuffer=0x2f83f60*, nNumberOfBytesToWrite=0xe090, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f83f60*, lpNumberOfBytesWritten=0x10af310*=0xe090, lpOverlapped=0x0) returned 1 [0045.738] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\V2XpokArQEslR4XPpUN.jpg", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\V2XpokArQEslR4XPpUN.jpg", lpFilePart=0x0) returned 0x36 [0045.738] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\V2XpokArQEslR4XPpUN.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\v2xpokarqeslr4xppun.jpg")) returned 1 [0045.785] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x2a [0045.785] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\", lpFilePart=0x0) returned 0x2b [0045.785] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145ca88 [0045.785] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.785] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.785] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0045.786] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0045.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0045.786] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x2a [0045.786] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\", lpFilePart=0x0) returned 0x2b [0045.786] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145ce48 [0045.786] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.786] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.786] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0045.786] FindClose (in: hFindFile=0x145ce48 | out: hFindFile=0x145ce48) returned 1 [0045.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0045.786] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM", lpFilePart=0x0) returned 0x30 [0045.786] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\", lpFilePart=0x0) returned 0x31 [0045.786] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c848 [0045.786] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.786] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0045.787] FindClose (in: hFindFile=0x145c848 | out: hFindFile=0x145c848) returned 1 [0045.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0045.787] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM", lpFilePart=0x0) returned 0x30 [0045.787] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\", lpFilePart=0x0) returned 0x31 [0045.787] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145ce48 [0045.787] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0045.787] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0045.787] FindClose (in: hFindFile=0x145ce48 | out: hFindFile=0x145ce48) returned 1 [0045.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0045.788] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\5KVbuoX6C7I.gif", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\5KVbuoX6C7I.gif", lpFilePart=0x0) returned 0x40 [0045.788] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\5KVbuoX6C7I.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\5kvbuox6c7i.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.788] GetFileType (hFile=0x398) returned 0x1 [0045.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0045.788] GetFileType (hFile=0x398) returned 0x1 [0045.788] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x5d7a [0045.788] ReadFile (in: hFile=0x398, lpBuffer=0x2f95dd8, nNumberOfBytesToRead=0x5d7a, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2f95dd8*, lpNumberOfBytesRead=0x10af2e4*=0x5d7a, lpOverlapped=0x0) returned 1 [0045.802] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\5KVbuoX6C7I.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\5KVbuoX6C7I.gif.ForgiveME", lpFilePart=0x0) returned 0x4a [0045.802] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\5KVbuoX6C7I.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\5kvbuox6c7i.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.802] GetFileType (hFile=0x398) returned 0x1 [0045.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0045.802] GetFileType (hFile=0x398) returned 0x1 [0045.802] WriteFile (in: hFile=0x398, lpBuffer=0x300000c*, nNumberOfBytesToWrite=0x5d80, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x300000c*, lpNumberOfBytesWritten=0x10af2d4*=0x5d80, lpOverlapped=0x0) returned 1 [0045.803] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\5KVbuoX6C7I.gif", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\5KVbuoX6C7I.gif", lpFilePart=0x0) returned 0x40 [0045.803] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\5KVbuoX6C7I.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\5kvbuox6c7i.gif")) returned 1 [0045.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\a GgqEm.gif", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\a GgqEm.gif", lpFilePart=0x0) returned 0x3c [0045.852] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\a GgqEm.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\a ggqem.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.852] GetFileType (hFile=0x398) returned 0x1 [0045.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0045.853] GetFileType (hFile=0x398) returned 0x1 [0045.853] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x9e5a [0045.853] ReadFile (in: hFile=0x398, lpBuffer=0x30060c4, nNumberOfBytesToRead=0x9e5a, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x30060c4*, lpNumberOfBytesRead=0x10af2e4*=0x9e5a, lpOverlapped=0x0) returned 1 [0045.930] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\a GgqEm.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\a GgqEm.gif.ForgiveME", lpFilePart=0x0) returned 0x46 [0045.930] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\a GgqEm.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\a ggqem.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0045.931] GetFileType (hFile=0x398) returned 0x1 [0045.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0045.931] GetFileType (hFile=0x398) returned 0x1 [0045.931] WriteFile (in: hFile=0x398, lpBuffer=0x2e85304*, nNumberOfBytesToWrite=0x9e60, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2e85304*, lpNumberOfBytesWritten=0x10af2d4*=0x9e60, lpOverlapped=0x0) returned 1 [0045.932] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\a GgqEm.gif", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\a GgqEm.gif", lpFilePart=0x0) returned 0x3c [0045.932] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\a GgqEm.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\a ggqem.gif")) returned 1 [0046.140] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\Cp5m9ui.png", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\Cp5m9ui.png", lpFilePart=0x0) returned 0x3c [0046.140] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\Cp5m9ui.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\cp5m9ui.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.140] GetFileType (hFile=0x398) returned 0x1 [0046.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0046.140] GetFileType (hFile=0x398) returned 0x1 [0046.140] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x1522e [0046.140] ReadFile (in: hFile=0x398, lpBuffer=0x405f090, nNumberOfBytesToRead=0x1522e, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x405f090*, lpNumberOfBytesRead=0x10af2e4*=0x1522e, lpOverlapped=0x0) returned 1 [0046.209] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\Cp5m9ui.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\Cp5m9ui.png.ForgiveME", lpFilePart=0x0) returned 0x46 [0046.209] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\Cp5m9ui.png.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\cp5m9ui.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.210] GetFileType (hFile=0x398) returned 0x1 [0046.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0046.210] GetFileType (hFile=0x398) returned 0x1 [0046.210] WriteFile (in: hFile=0x398, lpBuffer=0x40c8bc0*, nNumberOfBytesToWrite=0x15230, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x40c8bc0*, lpNumberOfBytesWritten=0x10af2d4*=0x15230, lpOverlapped=0x0) returned 1 [0046.211] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\Cp5m9ui.png", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\Cp5m9ui.png", lpFilePart=0x0) returned 0x3c [0046.211] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\Cp5m9ui.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\cp5m9ui.png")) returned 1 [0046.217] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\EfciVDOoFpXajDNdowI.png", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\EfciVDOoFpXajDNdowI.png", lpFilePart=0x0) returned 0x48 [0046.217] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\EfciVDOoFpXajDNdowI.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\efcivdoofpxajdndowi.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.217] GetFileType (hFile=0x398) returned 0x1 [0046.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0046.217] GetFileType (hFile=0x398) returned 0x1 [0046.218] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x10a91 [0046.218] ReadFile (in: hFile=0x398, lpBuffer=0x2edc7e0, nNumberOfBytesToRead=0x10a91, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2edc7e0*, lpNumberOfBytesRead=0x10af2e4*=0x10a91, lpOverlapped=0x0) returned 1 [0046.234] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\EfciVDOoFpXajDNdowI.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\EfciVDOoFpXajDNdowI.png.ForgiveME", lpFilePart=0x0) returned 0x52 [0046.234] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\EfciVDOoFpXajDNdowI.png.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\efcivdoofpxajdndowi.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.234] GetFileType (hFile=0x398) returned 0x1 [0046.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0046.234] GetFileType (hFile=0x398) returned 0x1 [0046.234] WriteFile (in: hFile=0x398, lpBuffer=0x2f5b698*, nNumberOfBytesToWrite=0x10aa0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2f5b698*, lpNumberOfBytesWritten=0x10af2d4*=0x10aa0, lpOverlapped=0x0) returned 1 [0046.236] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\EfciVDOoFpXajDNdowI.png", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\EfciVDOoFpXajDNdowI.png", lpFilePart=0x0) returned 0x48 [0046.236] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\EfciVDOoFpXajDNdowI.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\efcivdoofpxajdndowi.png")) returned 1 [0046.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\JYt B5eu2DQSpvUXEbj.jpg", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\JYt B5eu2DQSpvUXEbj.jpg", lpFilePart=0x0) returned 0x48 [0046.262] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\JYt B5eu2DQSpvUXEbj.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\jyt b5eu2dqspvuxebj.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.262] GetFileType (hFile=0x398) returned 0x1 [0046.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0046.262] GetFileType (hFile=0x398) returned 0x1 [0046.262] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0xe00f [0046.262] ReadFile (in: hFile=0x398, lpBuffer=0x2f6c4d0, nNumberOfBytesToRead=0xe00f, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2f6c4d0*, lpNumberOfBytesRead=0x10af2e4*=0xe00f, lpOverlapped=0x0) returned 1 [0046.300] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\JYt B5eu2DQSpvUXEbj.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\JYt B5eu2DQSpvUXEbj.jpg.ForgiveME", lpFilePart=0x0) returned 0x52 [0046.301] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\JYt B5eu2DQSpvUXEbj.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\jyt b5eu2dqspvuxebj.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.301] GetFileType (hFile=0x398) returned 0x1 [0046.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0046.301] GetFileType (hFile=0x398) returned 0x1 [0046.301] WriteFile (in: hFile=0x398, lpBuffer=0x2e14afc*, nNumberOfBytesToWrite=0xe010, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2e14afc*, lpNumberOfBytesWritten=0x10af2d4*=0xe010, lpOverlapped=0x0) returned 1 [0046.302] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\JYt B5eu2DQSpvUXEbj.jpg", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\JYt B5eu2DQSpvUXEbj.jpg", lpFilePart=0x0) returned 0x48 [0046.303] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\JYt B5eu2DQSpvUXEbj.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\jyt b5eu2dqspvuxebj.jpg")) returned 1 [0046.584] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\V9ilU.bmp", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\V9ilU.bmp", lpFilePart=0x0) returned 0x3a [0046.584] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\V9ilU.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\v9ilu.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.584] GetFileType (hFile=0x398) returned 0x1 [0046.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0046.585] GetFileType (hFile=0x398) returned 0x1 [0046.585] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x5063 [0046.585] ReadFile (in: hFile=0x398, lpBuffer=0x2e22e6c, nNumberOfBytesToRead=0x5063, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2e22e6c*, lpNumberOfBytesRead=0x10af2e4*=0x5063, lpOverlapped=0x0) returned 1 [0046.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\V9ilU.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\V9ilU.bmp.ForgiveME", lpFilePart=0x0) returned 0x44 [0046.599] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\V9ilU.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\v9ilu.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.600] GetFileType (hFile=0x398) returned 0x1 [0046.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0046.600] GetFileType (hFile=0x398) returned 0x1 [0046.600] WriteFile (in: hFile=0x398, lpBuffer=0x2e890a0*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2e890a0*, lpNumberOfBytesWritten=0x10af2d4*=0x5070, lpOverlapped=0x0) returned 1 [0046.601] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\V9ilU.bmp", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\V9ilU.bmp", lpFilePart=0x0) returned 0x3a [0046.601] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\V9ilU.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\v9ilu.bmp")) returned 1 [0046.616] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\x8sFphIUh2ONQFW.png", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\x8sFphIUh2ONQFW.png", lpFilePart=0x0) returned 0x44 [0046.616] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\x8sFphIUh2ONQFW.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\x8sfphiuh2onqfw.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.616] GetFileType (hFile=0x398) returned 0x1 [0046.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0046.616] GetFileType (hFile=0x398) returned 0x1 [0046.616] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x16d8e [0046.617] ReadFile (in: hFile=0x398, lpBuffer=0x3e158f0, nNumberOfBytesToRead=0x16d8e, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x3e158f0*, lpNumberOfBytesRead=0x10af2e4*=0x16d8e, lpOverlapped=0x0) returned 1 [0046.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\x8sFphIUh2ONQFW.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\x8sFphIUh2ONQFW.png.ForgiveME", lpFilePart=0x0) returned 0x4e [0046.639] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\x8sFphIUh2ONQFW.png.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\x8sfphiuh2onqfw.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.639] GetFileType (hFile=0x398) returned 0x1 [0046.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0046.639] GetFileType (hFile=0x398) returned 0x1 [0046.639] WriteFile (in: hFile=0x398, lpBuffer=0x3e87d00*, nNumberOfBytesToWrite=0x16d90, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x3e87d00*, lpNumberOfBytesWritten=0x10af2d4*=0x16d90, lpOverlapped=0x0) returned 1 [0046.641] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\x8sFphIUh2ONQFW.png", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\x8sFphIUh2ONQFW.png", lpFilePart=0x0) returned 0x44 [0046.641] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Dqfv9WDeoOJ1wv7KM\\x8sFphIUh2ONQFW.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\dqfv9wdeooj1wv7km\\x8sfphiuh2onqfw.png")) returned 1 [0046.656] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb", lpFilePart=0x0) returned 0x29 [0046.656] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\", lpFilePart=0x0) returned 0x2a [0046.656] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145cd08 [0046.656] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.656] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.656] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.656] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.656] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.656] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.656] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.656] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.656] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.656] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0046.656] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0046.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0046.656] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb", lpFilePart=0x0) returned 0x29 [0046.656] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\", lpFilePart=0x0) returned 0x2a [0046.656] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145cd88 [0046.657] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.657] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.657] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.657] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.657] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.657] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.657] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.657] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.657] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0046.657] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0046.657] FindClose (in: hFindFile=0x145cd88 | out: hFindFile=0x145cd88) returned 1 [0046.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0046.657] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\1GK2iwe7p.jpg", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\1GK2iwe7p.jpg", lpFilePart=0x0) returned 0x37 [0046.657] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\1GK2iwe7p.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\1gk2iwe7p.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.657] GetFileType (hFile=0x398) returned 0x1 [0046.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0046.657] GetFileType (hFile=0x398) returned 0x1 [0046.657] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x2519 [0046.657] ReadFile (in: hFile=0x398, lpBuffer=0x2eddc78, nNumberOfBytesToRead=0x2519, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2eddc78*, lpNumberOfBytesRead=0x10af2e4*=0x2519, lpOverlapped=0x0) returned 1 [0046.672] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\1GK2iwe7p.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\1GK2iwe7p.jpg.ForgiveME", lpFilePart=0x0) returned 0x41 [0046.672] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\1GK2iwe7p.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\1gk2iwe7p.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.673] GetFileType (hFile=0x398) returned 0x1 [0046.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0046.673] GetFileType (hFile=0x398) returned 0x1 [0046.673] WriteFile (in: hFile=0x398, lpBuffer=0x2f364b8*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2f364b8*, lpNumberOfBytesWritten=0x10af2d4*=0x2520, lpOverlapped=0x0) returned 1 [0046.674] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\1GK2iwe7p.jpg", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\1GK2iwe7p.jpg", lpFilePart=0x0) returned 0x37 [0046.674] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\1GK2iwe7p.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\1gk2iwe7p.jpg")) returned 1 [0046.679] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\fETx.bmp", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\fETx.bmp", lpFilePart=0x0) returned 0x32 [0046.679] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\fETx.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\fetx.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.680] GetFileType (hFile=0x398) returned 0x1 [0046.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0046.680] GetFileType (hFile=0x398) returned 0x1 [0046.680] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x84f9 [0046.680] ReadFile (in: hFile=0x398, lpBuffer=0x2f38ccc, nNumberOfBytesToRead=0x84f9, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2f38ccc*, lpNumberOfBytesRead=0x10af2e4*=0x84f9, lpOverlapped=0x0) returned 1 [0046.694] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\fETx.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\fETx.bmp.ForgiveME", lpFilePart=0x0) returned 0x3c [0046.694] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\fETx.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\fetx.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.695] GetFileType (hFile=0x398) returned 0x1 [0046.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0046.695] GetFileType (hFile=0x398) returned 0x1 [0046.695] WriteFile (in: hFile=0x398, lpBuffer=0x2faf464*, nNumberOfBytesToWrite=0x8500, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2faf464*, lpNumberOfBytesWritten=0x10af2d4*=0x8500, lpOverlapped=0x0) returned 1 [0046.696] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\fETx.bmp", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\fETx.bmp", lpFilePart=0x0) returned 0x32 [0046.696] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\fETx.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\fetx.bmp")) returned 1 [0046.697] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\lesA3Ej.jpg", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\lesA3Ej.jpg", lpFilePart=0x0) returned 0x35 [0046.697] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\lesA3Ej.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\lesa3ej.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.697] GetFileType (hFile=0x398) returned 0x1 [0046.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0046.698] GetFileType (hFile=0x398) returned 0x1 [0046.698] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x26dc [0046.698] ReadFile (in: hFile=0x398, lpBuffer=0x2fb7c48, nNumberOfBytesToRead=0x26dc, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2fb7c48*, lpNumberOfBytesRead=0x10af2e4*=0x26dc, lpOverlapped=0x0) returned 1 [0046.712] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\lesA3Ej.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\lesA3Ej.jpg.ForgiveME", lpFilePart=0x0) returned 0x3f [0046.712] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\lesA3Ej.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\lesa3ej.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.712] GetFileType (hFile=0x398) returned 0x1 [0046.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0046.712] GetFileType (hFile=0x398) returned 0x1 [0046.712] WriteFile (in: hFile=0x398, lpBuffer=0x3010d40*, nNumberOfBytesToWrite=0x26e0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x3010d40*, lpNumberOfBytesWritten=0x10af2d4*=0x26e0, lpOverlapped=0x0) returned 1 [0046.713] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\lesA3Ej.jpg", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\lesA3Ej.jpg", lpFilePart=0x0) returned 0x35 [0046.713] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\lesA3Ej.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\lesa3ej.jpg")) returned 1 [0046.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\PmRRRaM0.jpg", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\PmRRRaM0.jpg", lpFilePart=0x0) returned 0x36 [0046.715] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\PmRRRaM0.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\pmrrram0.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.715] GetFileType (hFile=0x398) returned 0x1 [0046.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0046.715] GetFileType (hFile=0x398) returned 0x1 [0046.715] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0xc26b [0046.716] ReadFile (in: hFile=0x398, lpBuffer=0x2e14f98, nNumberOfBytesToRead=0xc26b, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2e14f98*, lpNumberOfBytesRead=0x10af2e4*=0xc26b, lpOverlapped=0x0) returned 1 [0046.733] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\PmRRRaM0.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\PmRRRaM0.jpg.ForgiveME", lpFilePart=0x0) returned 0x40 [0046.733] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\PmRRRaM0.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\pmrrram0.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.733] GetFileType (hFile=0x398) returned 0x1 [0046.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0046.733] GetFileType (hFile=0x398) returned 0x1 [0046.733] WriteFile (in: hFile=0x398, lpBuffer=0x2e866f8*, nNumberOfBytesToWrite=0xc270, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2e866f8*, lpNumberOfBytesWritten=0x10af2d4*=0xc270, lpOverlapped=0x0) returned 1 [0046.734] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\PmRRRaM0.jpg", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\PmRRRaM0.jpg", lpFilePart=0x0) returned 0x36 [0046.734] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\PmRRRaM0.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\pmrrram0.jpg")) returned 1 [0046.774] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\vS5aAlhJ.png", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\vS5aAlhJ.png", lpFilePart=0x0) returned 0x36 [0046.774] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\vS5aAlhJ.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\vs5aalhj.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.774] GetFileType (hFile=0x398) returned 0x1 [0046.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0046.774] GetFileType (hFile=0x398) returned 0x1 [0046.774] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x17990 [0046.774] ReadFile (in: hFile=0x398, lpBuffer=0x3eb6f90, nNumberOfBytesToRead=0x17990, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x3eb6f90*, lpNumberOfBytesRead=0x10af2e4*=0x17990, lpOverlapped=0x0) returned 1 [0046.795] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\vS5aAlhJ.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\vS5aAlhJ.png.ForgiveME", lpFilePart=0x0) returned 0x40 [0046.795] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\vS5aAlhJ.png.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\vs5aalhj.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.795] GetFileType (hFile=0x398) returned 0x1 [0046.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0046.795] GetFileType (hFile=0x398) returned 0x1 [0046.795] WriteFile (in: hFile=0x398, lpBuffer=0x3f2cfe0*, nNumberOfBytesToWrite=0x179a0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x3f2cfe0*, lpNumberOfBytesWritten=0x10af2d4*=0x179a0, lpOverlapped=0x0) returned 1 [0046.797] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\vS5aAlhJ.png", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\vS5aAlhJ.png", lpFilePart=0x0) returned 0x36 [0046.797] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\vS5aAlhJ.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\vs5aalhj.png")) returned 1 [0046.800] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\xr d6XROhOsECFoi.gif", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\xr d6XROhOsECFoi.gif", lpFilePart=0x0) returned 0x3e [0046.800] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\xr d6XROhOsECFoi.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\xr d6xrohosecfoi.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.800] GetFileType (hFile=0x398) returned 0x1 [0046.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0046.800] GetFileType (hFile=0x398) returned 0x1 [0046.800] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0xed31 [0046.800] ReadFile (in: hFile=0x398, lpBuffer=0x2edfe40, nNumberOfBytesToRead=0xed31, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2edfe40*, lpNumberOfBytesRead=0x10af2e4*=0xed31, lpOverlapped=0x0) returned 1 [0046.817] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\xr d6XROhOsECFoi.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\xr d6XROhOsECFoi.gif.ForgiveME", lpFilePart=0x0) returned 0x48 [0046.817] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\xr d6XROhOsECFoi.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\xr d6xrohosecfoi.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.818] GetFileType (hFile=0x398) returned 0x1 [0046.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0046.818] GetFileType (hFile=0x398) returned 0x1 [0046.818] WriteFile (in: hFile=0x398, lpBuffer=0x2f594c4*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2f594c4*, lpNumberOfBytesWritten=0x10af2d4*=0xed40, lpOverlapped=0x0) returned 1 [0046.819] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\xr d6XROhOsECFoi.gif", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\xr d6XROhOsECFoi.gif", lpFilePart=0x0) returned 0x3e [0046.819] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\xr d6XROhOsECFoi.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\xr d6xrohosecfoi.gif")) returned 1 [0046.848] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT", lpFilePart=0x0) returned 0x33 [0046.848] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\", lpFilePart=0x0) returned 0x34 [0046.848] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c888 [0046.849] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.849] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.849] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.849] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.849] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0046.849] FindClose (in: hFindFile=0x145c888 | out: hFindFile=0x145c888) returned 1 [0046.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0046.849] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT", lpFilePart=0x0) returned 0x33 [0046.849] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\", lpFilePart=0x0) returned 0x34 [0046.849] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cb08 [0046.849] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.849] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.849] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.849] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.849] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0046.849] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0046.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0046.850] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\7EZ4GtS3eucc.gif", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\7EZ4GtS3eucc.gif", lpFilePart=0x0) returned 0x44 [0046.850] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\7EZ4GtS3eucc.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\mwcobuqut\\7ez4gts3eucc.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.850] GetFileType (hFile=0x398) returned 0x1 [0046.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0046.850] GetFileType (hFile=0x398) returned 0x1 [0046.850] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0xc2d9 [0046.850] ReadFile (in: hFile=0x398, lpBuffer=0x2f6a07c, nNumberOfBytesToRead=0xc2d9, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a07c*, lpNumberOfBytesRead=0x10af2a8*=0xc2d9, lpOverlapped=0x0) returned 1 [0046.866] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\7EZ4GtS3eucc.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\7EZ4GtS3eucc.gif.ForgiveME", lpFilePart=0x0) returned 0x4e [0046.866] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\7EZ4GtS3eucc.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\mwcobuqut\\7ez4gts3eucc.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.867] GetFileType (hFile=0x398) returned 0x1 [0046.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0046.867] GetFileType (hFile=0x398) returned 0x1 [0046.867] WriteFile (in: hFile=0x398, lpBuffer=0x2fdb7ec*, nNumberOfBytesToWrite=0xc2e0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2fdb7ec*, lpNumberOfBytesWritten=0x10af298*=0xc2e0, lpOverlapped=0x0) returned 1 [0046.868] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\7EZ4GtS3eucc.gif", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\7EZ4GtS3eucc.gif", lpFilePart=0x0) returned 0x44 [0046.868] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\7EZ4GtS3eucc.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\mwcobuqut\\7ez4gts3eucc.gif")) returned 1 [0046.875] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\FWIZqvAtIpB.bmp", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\FWIZqvAtIpB.bmp", lpFilePart=0x0) returned 0x43 [0046.875] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\FWIZqvAtIpB.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\mwcobuqut\\fwizqvatipb.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.876] GetFileType (hFile=0x398) returned 0x1 [0046.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0046.876] GetFileType (hFile=0x398) returned 0x1 [0046.876] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x14ac1 [0046.876] ReadFile (in: hFile=0x398, lpBuffer=0x2fe7e2c, nNumberOfBytesToRead=0x14ac1, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2fe7e2c*, lpNumberOfBytesRead=0x10af2a8*=0x14ac1, lpOverlapped=0x0) returned 1 [0046.896] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\FWIZqvAtIpB.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\FWIZqvAtIpB.bmp.ForgiveME", lpFilePart=0x0) returned 0x4d [0046.896] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\FWIZqvAtIpB.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\mwcobuqut\\fwizqvatipb.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.896] GetFileType (hFile=0x398) returned 0x1 [0046.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0046.896] GetFileType (hFile=0x398) returned 0x1 [0046.897] WriteFile (in: hFile=0x398, lpBuffer=0x2e8814c*, nNumberOfBytesToWrite=0x14ad0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2e8814c*, lpNumberOfBytesWritten=0x10af298*=0x14ad0, lpOverlapped=0x0) returned 1 [0046.898] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\FWIZqvAtIpB.bmp", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\FWIZqvAtIpB.bmp", lpFilePart=0x0) returned 0x43 [0046.898] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\FWIZqvAtIpB.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\mwcobuqut\\fwizqvatipb.bmp")) returned 1 [0046.901] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\v9-w8Y.gif", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\v9-w8Y.gif", lpFilePart=0x0) returned 0x3e [0046.901] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\v9-w8Y.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\mwcobuqut\\v9-w8y.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.901] GetFileType (hFile=0x398) returned 0x1 [0046.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0046.901] GetFileType (hFile=0x398) returned 0x1 [0046.901] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x12ee9 [0046.901] ReadFile (in: hFile=0x398, lpBuffer=0x2e9cf60, nNumberOfBytesToRead=0x12ee9, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2e9cf60*, lpNumberOfBytesRead=0x10af2a8*=0x12ee9, lpOverlapped=0x0) returned 1 [0046.922] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\v9-w8Y.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\v9-w8Y.gif.ForgiveME", lpFilePart=0x0) returned 0x48 [0046.923] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\v9-w8Y.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\mwcobuqut\\v9-w8y.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.923] GetFileType (hFile=0x398) returned 0x1 [0046.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0046.923] GetFileType (hFile=0x398) returned 0x1 [0046.923] WriteFile (in: hFile=0x398, lpBuffer=0x2f22c50*, nNumberOfBytesToWrite=0x12ef0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2f22c50*, lpNumberOfBytesWritten=0x10af298*=0x12ef0, lpOverlapped=0x0) returned 1 [0046.926] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\v9-w8Y.gif", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\v9-w8Y.gif", lpFilePart=0x0) returned 0x3e [0046.926] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\MWcObuqUT\\v9-w8Y.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\mwcobuqut\\v9-w8y.gif")) returned 1 [0046.929] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d", lpFilePart=0x0) returned 0x37 [0046.929] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\", lpFilePart=0x0) returned 0x38 [0046.929] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145ca88 [0046.929] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.930] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.930] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.930] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.930] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.930] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.930] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0046.930] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0046.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0046.930] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d", lpFilePart=0x0) returned 0x37 [0046.930] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\", lpFilePart=0x0) returned 0x38 [0046.931] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c948 [0046.931] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.931] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.931] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.931] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.931] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.931] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0046.931] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0046.931] FindClose (in: hFindFile=0x145c948 | out: hFindFile=0x145c948) returned 1 [0046.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0046.932] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\0Elckohhrs6BzmQizNDC.gif", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\0Elckohhrs6BzmQizNDC.gif", lpFilePart=0x0) returned 0x50 [0046.932] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\0Elckohhrs6BzmQizNDC.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\0elckohhrs6bzmqizndc.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.932] GetFileType (hFile=0x398) returned 0x1 [0046.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0046.932] GetFileType (hFile=0x398) returned 0x1 [0046.932] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0xddf [0046.932] ReadFile (in: hFile=0x398, lpBuffer=0x2f38f58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2f38f58*, lpNumberOfBytesRead=0x10af2a8*=0xddf, lpOverlapped=0x0) returned 1 [0046.946] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\0Elckohhrs6BzmQizNDC.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\0Elckohhrs6BzmQizNDC.gif.ForgiveME", lpFilePart=0x0) returned 0x5a [0046.946] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\0Elckohhrs6BzmQizNDC.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\0elckohhrs6bzmqizndc.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.947] GetFileType (hFile=0x398) returned 0x1 [0046.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0046.947] GetFileType (hFile=0x398) returned 0x1 [0046.947] WriteFile (in: hFile=0x398, lpBuffer=0x2f8b50c*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2f8b50c*, lpNumberOfBytesWritten=0x10af26c*=0xde0, lpOverlapped=0x0) returned 1 [0046.948] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\0Elckohhrs6BzmQizNDC.gif", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\0Elckohhrs6BzmQizNDC.gif", lpFilePart=0x0) returned 0x50 [0046.948] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\0Elckohhrs6BzmQizNDC.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\0elckohhrs6bzmqizndc.gif")) returned 1 [0046.957] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\jj7t4P-k.gif", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\jj7t4P-k.gif", lpFilePart=0x0) returned 0x44 [0046.957] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\jj7t4P-k.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\jj7t4p-k.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.957] GetFileType (hFile=0x398) returned 0x1 [0046.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0046.957] GetFileType (hFile=0x398) returned 0x1 [0046.958] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x17862 [0046.958] ReadFile (in: hFile=0x398, lpBuffer=0x3fc9d60, nNumberOfBytesToRead=0x17862, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x3fc9d60*, lpNumberOfBytesRead=0x10af2a8*=0x17862, lpOverlapped=0x0) returned 1 [0046.979] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\jj7t4P-k.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\jj7t4P-k.gif.ForgiveME", lpFilePart=0x0) returned 0x4e [0046.979] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\jj7t4P-k.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\jj7t4p-k.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.980] GetFileType (hFile=0x398) returned 0x1 [0046.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0046.980] GetFileType (hFile=0x398) returned 0x1 [0046.980] WriteFile (in: hFile=0x398, lpBuffer=0x403f7c0*, nNumberOfBytesToWrite=0x17870, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x403f7c0*, lpNumberOfBytesWritten=0x10af298*=0x17870, lpOverlapped=0x0) returned 1 [0046.981] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\jj7t4P-k.gif", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\jj7t4P-k.gif", lpFilePart=0x0) returned 0x44 [0046.981] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\jj7t4P-k.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\jj7t4p-k.gif")) returned 1 [0046.984] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR", lpFilePart=0x0) returned 0x3f [0046.984] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\", lpFilePart=0x0) returned 0x40 [0046.984] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c8c8 [0046.985] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0046.985] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0046.985] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0046.985] FindClose (in: hFindFile=0x145c8c8 | out: hFindFile=0x145c8c8) returned 1 [0046.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0046.985] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR", lpFilePart=0x0) returned 0x3f [0046.985] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\", lpFilePart=0x0) returned 0x40 [0046.985] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145ca88 [0046.985] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0046.985] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0046.986] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0046.986] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0046.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0046.986] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\-pO iFu69ZDsH.png", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\-pO iFu69ZDsH.png", lpFilePart=0x0) returned 0x51 [0046.986] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\-pO iFu69ZDsH.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\-edprtr\\-po ifu69zdsh.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0046.986] GetFileType (hFile=0x398) returned 0x1 [0046.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0046.986] GetFileType (hFile=0x398) returned 0x1 [0046.987] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0xbd59 [0046.987] ReadFile (in: hFile=0x398, lpBuffer=0x2fdb160, nNumberOfBytesToRead=0xbd59, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2fdb160*, lpNumberOfBytesRead=0x10af26c*=0xbd59, lpOverlapped=0x0) returned 1 [0047.011] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\-pO iFu69ZDsH.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\-pO iFu69ZDsH.png.ForgiveME", lpFilePart=0x0) returned 0x5b [0047.011] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\-pO iFu69ZDsH.png.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\-edprtr\\-po ifu69zdsh.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.011] GetFileType (hFile=0x398) returned 0x1 [0047.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0047.011] GetFileType (hFile=0x398) returned 0x1 [0047.011] WriteFile (in: hFile=0x398, lpBuffer=0x2e58030*, nNumberOfBytesToWrite=0xbd60, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2e58030*, lpNumberOfBytesWritten=0x10af25c*=0xbd60, lpOverlapped=0x0) returned 1 [0047.012] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\-pO iFu69ZDsH.png", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\-pO iFu69ZDsH.png", lpFilePart=0x0) returned 0x51 [0047.012] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\-eDPrTR\\-pO iFu69ZDsH.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\-edprtr\\-po ifu69zdsh.png")) returned 1 [0047.015] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n", lpFilePart=0x0) returned 0x3f [0047.015] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\", lpFilePart=0x0) returned 0x40 [0047.015] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c848 [0047.015] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0047.016] FindClose (in: hFindFile=0x145c848 | out: hFindFile=0x145c848) returned 1 [0047.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0047.016] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n", lpFilePart=0x0) returned 0x3f [0047.016] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\", lpFilePart=0x0) returned 0x40 [0047.016] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145ca88 [0047.016] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.016] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.017] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0047.017] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0047.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0047.017] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\1R-gVDqQyZ-z0tidUvhb.bmp", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\1R-gVDqQyZ-z0tidUvhb.bmp", lpFilePart=0x0) returned 0x58 [0047.017] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\1R-gVDqQyZ-z0tidUvhb.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\cbfs0 n\\1r-gvdqqyz-z0tiduvhb.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.017] GetFileType (hFile=0x398) returned 0x1 [0047.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0047.017] GetFileType (hFile=0x398) returned 0x1 [0047.017] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x2bd8 [0047.024] ReadFile (in: hFile=0x398, lpBuffer=0x2e661dc, nNumberOfBytesToRead=0x2bd8, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2e661dc*, lpNumberOfBytesRead=0x10af26c*=0x2bd8, lpOverlapped=0x0) returned 1 [0047.040] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\1R-gVDqQyZ-z0tidUvhb.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\1R-gVDqQyZ-z0tidUvhb.bmp.ForgiveME", lpFilePart=0x0) returned 0x62 [0047.040] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\1R-gVDqQyZ-z0tidUvhb.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\cbfs0 n\\1r-gvdqqyz-z0tiduvhb.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.040] GetFileType (hFile=0x398) returned 0x1 [0047.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0047.040] GetFileType (hFile=0x398) returned 0x1 [0047.040] WriteFile (in: hFile=0x398, lpBuffer=0x2ec0d78*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2ec0d78*, lpNumberOfBytesWritten=0x10af25c*=0x2be0, lpOverlapped=0x0) returned 1 [0047.041] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\1R-gVDqQyZ-z0tidUvhb.bmp", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\1R-gVDqQyZ-z0tidUvhb.bmp", lpFilePart=0x0) returned 0x58 [0047.041] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\1R-gVDqQyZ-z0tidUvhb.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\cbfs0 n\\1r-gvdqqyz-z0tiduvhb.bmp")) returned 1 [0047.042] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\2zm67v1dYDdfQe.png", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\2zm67v1dYDdfQe.png", lpFilePart=0x0) returned 0x52 [0047.042] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\2zm67v1dYDdfQe.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\cbfs0 n\\2zm67v1dyddfqe.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.042] GetFileType (hFile=0x398) returned 0x1 [0047.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0047.043] GetFileType (hFile=0x398) returned 0x1 [0047.043] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x11cce [0047.043] ReadFile (in: hFile=0x398, lpBuffer=0x2ec3d40, nNumberOfBytesToRead=0x11cce, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2ec3d40*, lpNumberOfBytesRead=0x10af26c*=0x11cce, lpOverlapped=0x0) returned 1 [0047.058] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\2zm67v1dYDdfQe.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\2zm67v1dYDdfQe.png.ForgiveME", lpFilePart=0x0) returned 0x5c [0047.059] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\2zm67v1dYDdfQe.png.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\cbfs0 n\\2zm67v1dyddfqe.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.059] GetFileType (hFile=0x398) returned 0x1 [0047.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0047.059] GetFileType (hFile=0x398) returned 0x1 [0047.059] WriteFile (in: hFile=0x398, lpBuffer=0x2f4629c*, nNumberOfBytesToWrite=0x11cd0, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2f4629c*, lpNumberOfBytesWritten=0x10af25c*=0x11cd0, lpOverlapped=0x0) returned 1 [0047.060] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\2zm67v1dYDdfQe.png", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\2zm67v1dYDdfQe.png", lpFilePart=0x0) returned 0x52 [0047.060] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\2zm67v1dYDdfQe.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\cbfs0 n\\2zm67v1dyddfqe.png")) returned 1 [0047.067] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\fV9gs2uPtrSIMKeAHGmD.jpg", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\fV9gs2uPtrSIMKeAHGmD.jpg", lpFilePart=0x0) returned 0x58 [0047.067] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\fV9gs2uPtrSIMKeAHGmD.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\cbfs0 n\\fv9gs2uptrsimkeahgmd.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.067] GetFileType (hFile=0x398) returned 0x1 [0047.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0047.067] GetFileType (hFile=0x398) returned 0x1 [0047.067] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x10295 [0047.067] ReadFile (in: hFile=0x398, lpBuffer=0x2f58348, nNumberOfBytesToRead=0x10295, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2f58348*, lpNumberOfBytesRead=0x10af26c*=0x10295, lpOverlapped=0x0) returned 1 [0047.083] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\fV9gs2uPtrSIMKeAHGmD.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\fV9gs2uPtrSIMKeAHGmD.jpg.ForgiveME", lpFilePart=0x0) returned 0x62 [0047.083] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\fV9gs2uPtrSIMKeAHGmD.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\cbfs0 n\\fv9gs2uptrsimkeahgmd.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.084] GetFileType (hFile=0x398) returned 0x1 [0047.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0047.084] GetFileType (hFile=0x398) returned 0x1 [0047.084] WriteFile (in: hFile=0x398, lpBuffer=0x2fd5a20*, nNumberOfBytesToWrite=0x102a0, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2fd5a20*, lpNumberOfBytesWritten=0x10af25c*=0x102a0, lpOverlapped=0x0) returned 1 [0047.085] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\fV9gs2uPtrSIMKeAHGmD.jpg", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\fV9gs2uPtrSIMKeAHGmD.jpg", lpFilePart=0x0) returned 0x58 [0047.085] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\CBFS0 n\\fV9gs2uPtrSIMKeAHGmD.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\cbfs0 n\\fv9gs2uptrsimkeahgmd.jpg")) returned 1 [0047.088] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP", lpFilePart=0x0) returned 0x44 [0047.088] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\", lpFilePart=0x0) returned 0x45 [0047.088] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb08 [0047.088] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.089] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.089] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.089] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.089] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0047.089] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0047.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0047.089] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP", lpFilePart=0x0) returned 0x44 [0047.089] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\", lpFilePart=0x0) returned 0x45 [0047.089] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c788 [0047.089] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.089] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.090] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.090] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0047.090] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0047.090] FindClose (in: hFindFile=0x145c788 | out: hFindFile=0x145c788) returned 1 [0047.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0047.090] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\KDaf1EJeF5D5 RP5J.png", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\KDaf1EJeF5D5 RP5J.png", lpFilePart=0x0) returned 0x5a [0047.090] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\KDaf1EJeF5D5 RP5J.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\x4hn7giq6asp\\kdaf1ejef5d5 rp5j.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.090] GetFileType (hFile=0x398) returned 0x1 [0047.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0047.090] GetFileType (hFile=0x398) returned 0x1 [0047.090] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x4a3c [0047.090] ReadFile (in: hFile=0x398, lpBuffer=0x2fe809c, nNumberOfBytesToRead=0x4a3c, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2fe809c*, lpNumberOfBytesRead=0x10af26c*=0x4a3c, lpOverlapped=0x0) returned 1 [0047.114] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\KDaf1EJeF5D5 RP5J.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\KDaf1EJeF5D5 RP5J.png.ForgiveME", lpFilePart=0x0) returned 0x64 [0047.114] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\KDaf1EJeF5D5 RP5J.png.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\x4hn7giq6asp\\kdaf1ejef5d5 rp5j.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.120] GetFileType (hFile=0x398) returned 0x1 [0047.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0047.120] GetFileType (hFile=0x398) returned 0x1 [0047.120] WriteFile (in: hFile=0x398, lpBuffer=0x2e45138*, nNumberOfBytesToWrite=0x4a40, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2e45138*, lpNumberOfBytesWritten=0x10af25c*=0x4a40, lpOverlapped=0x0) returned 1 [0047.121] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\KDaf1EJeF5D5 RP5J.png", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\KDaf1EJeF5D5 RP5J.png", lpFilePart=0x0) returned 0x5a [0047.121] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\KDaf1EJeF5D5 RP5J.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\x4hn7giq6asp\\kdaf1ejef5d5 rp5j.png")) returned 1 [0047.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\ppuAT.jpg", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\ppuAT.jpg", lpFilePart=0x0) returned 0x4e [0047.134] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\ppuAT.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\x4hn7giq6asp\\ppuat.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.135] GetFileType (hFile=0x398) returned 0x1 [0047.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0047.135] GetFileType (hFile=0x398) returned 0x1 [0047.135] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x15216 [0047.135] ReadFile (in: hFile=0x398, lpBuffer=0x40b29f0, nNumberOfBytesToRead=0x15216, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x40b29f0*, lpNumberOfBytesRead=0x10af26c*=0x15216, lpOverlapped=0x0) returned 1 [0047.163] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\ppuAT.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\ppuAT.jpg.ForgiveME", lpFilePart=0x0) returned 0x58 [0047.163] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\ppuAT.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\x4hn7giq6asp\\ppuat.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.164] GetFileType (hFile=0x398) returned 0x1 [0047.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0047.164] GetFileType (hFile=0x398) returned 0x1 [0047.164] WriteFile (in: hFile=0x398, lpBuffer=0x3df98d0*, nNumberOfBytesToWrite=0x15220, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x3df98d0*, lpNumberOfBytesWritten=0x10af25c*=0x15220, lpOverlapped=0x0) returned 1 [0047.165] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\ppuAT.jpg", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\ppuAT.jpg", lpFilePart=0x0) returned 0x4e [0047.165] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\ppuAT.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\x4hn7giq6asp\\ppuat.jpg")) returned 1 [0047.167] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\rkgbPk.gif", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\rkgbPk.gif", lpFilePart=0x0) returned 0x4f [0047.167] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\rkgbPk.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\x4hn7giq6asp\\rkgbpk.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.167] GetFileType (hFile=0x398) returned 0x1 [0047.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0047.168] GetFileType (hFile=0x398) returned 0x1 [0047.168] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x59a4 [0047.168] ReadFile (in: hFile=0x398, lpBuffer=0x2e06b20, nNumberOfBytesToRead=0x59a4, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2e06b20*, lpNumberOfBytesRead=0x10af26c*=0x59a4, lpOverlapped=0x0) returned 1 [0047.183] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\rkgbPk.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\rkgbPk.gif.ForgiveME", lpFilePart=0x0) returned 0x59 [0047.183] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\rkgbPk.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\x4hn7giq6asp\\rkgbpk.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.183] GetFileType (hFile=0x398) returned 0x1 [0047.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0047.183] GetFileType (hFile=0x398) returned 0x1 [0047.183] WriteFile (in: hFile=0x398, lpBuffer=0x2e6fbb8*, nNumberOfBytesToWrite=0x59b0, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2e6fbb8*, lpNumberOfBytesWritten=0x10af25c*=0x59b0, lpOverlapped=0x0) returned 1 [0047.184] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\rkgbPk.gif", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\rkgbPk.gif", lpFilePart=0x0) returned 0x4f [0047.184] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\GM_1JVqNUb\\n4vAqC57_uq8d\\x4hn7gIQ6aSP\\rkgbPk.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\gm_1jvqnub\\n4vaqc57_uq8d\\x4hn7giq6asp\\rkgbpk.gif")) returned 1 [0047.192] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR", lpFilePart=0x0) returned 0x28 [0047.192] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\", lpFilePart=0x0) returned 0x29 [0047.192] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145cc88 [0047.192] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.192] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.192] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.192] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0047.192] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0047.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0047.193] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR", lpFilePart=0x0) returned 0x28 [0047.193] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\", lpFilePart=0x0) returned 0x29 [0047.193] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145cb48 [0047.193] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.193] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.193] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.193] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0047.193] FindClose (in: hFindFile=0x145cb48 | out: hFindFile=0x145cb48) returned 1 [0047.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0047.193] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\g_IdIecJjIpqXVu1uaF.gif", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\g_IdIecJjIpqXVu1uaF.gif", lpFilePart=0x0) returned 0x40 [0047.194] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\g_IdIecJjIpqXVu1uaF.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qdvktojjr\\g_idiecjjipqxvu1uaf.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.194] GetFileType (hFile=0x398) returned 0x1 [0047.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.194] GetFileType (hFile=0x398) returned 0x1 [0047.194] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x160d7 [0047.194] ReadFile (in: hFile=0x398, lpBuffer=0x3e0eb10, nNumberOfBytesToRead=0x160d7, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x3e0eb10*, lpNumberOfBytesRead=0x10af2e4*=0x160d7, lpOverlapped=0x0) returned 1 [0047.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\g_IdIecJjIpqXVu1uaF.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\g_IdIecJjIpqXVu1uaF.gif.ForgiveME", lpFilePart=0x0) returned 0x4a [0047.254] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\g_IdIecJjIpqXVu1uaF.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qdvktojjr\\g_idiecjjipqxvu1uaf.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.264] GetFileType (hFile=0x398) returned 0x1 [0047.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.264] GetFileType (hFile=0x398) returned 0x1 [0047.264] WriteFile (in: hFile=0x398, lpBuffer=0x3e7cfa8*, nNumberOfBytesToWrite=0x160e0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x3e7cfa8*, lpNumberOfBytesWritten=0x10af2d4*=0x160e0, lpOverlapped=0x0) returned 1 [0047.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\g_IdIecJjIpqXVu1uaF.gif", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\g_IdIecJjIpqXVu1uaF.gif", lpFilePart=0x0) returned 0x40 [0047.266] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\g_IdIecJjIpqXVu1uaF.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qdvktojjr\\g_idiecjjipqxvu1uaf.gif")) returned 1 [0047.267] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH", lpFilePart=0x0) returned 0x31 [0047.267] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\", lpFilePart=0x0) returned 0x32 [0047.269] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cd88 [0047.269] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.270] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.270] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.270] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.270] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0047.270] FindClose (in: hFindFile=0x145cd88 | out: hFindFile=0x145cd88) returned 1 [0047.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0047.270] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH", lpFilePart=0x0) returned 0x31 [0047.270] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\", lpFilePart=0x0) returned 0x32 [0047.270] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145ce08 [0047.270] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.270] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.271] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.271] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.271] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0047.271] FindClose (in: hFindFile=0x145ce08 | out: hFindFile=0x145ce08) returned 1 [0047.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0047.271] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\38CkYWeudH.gif", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\38CkYWeudH.gif", lpFilePart=0x0) returned 0x40 [0047.271] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\38CkYWeudH.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qdvktojjr\\a0hferbh\\38ckyweudh.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.271] GetFileType (hFile=0x398) returned 0x1 [0047.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0047.271] GetFileType (hFile=0x398) returned 0x1 [0047.271] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x9696 [0047.271] ReadFile (in: hFile=0x398, lpBuffer=0x2ec5af0, nNumberOfBytesToRead=0x9696, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2ec5af0*, lpNumberOfBytesRead=0x10af2a8*=0x9696, lpOverlapped=0x0) returned 1 [0047.289] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\38CkYWeudH.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\38CkYWeudH.gif.ForgiveME", lpFilePart=0x0) returned 0x4a [0047.289] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\38CkYWeudH.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qdvktojjr\\a0hferbh\\38ckyweudh.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.298] GetFileType (hFile=0x398) returned 0x1 [0047.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0047.298] GetFileType (hFile=0x398) returned 0x1 [0047.298] WriteFile (in: hFile=0x398, lpBuffer=0x2f41ac4*, nNumberOfBytesToWrite=0x96a0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2f41ac4*, lpNumberOfBytesWritten=0x10af298*=0x96a0, lpOverlapped=0x0) returned 1 [0047.303] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\38CkYWeudH.gif", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\38CkYWeudH.gif", lpFilePart=0x0) returned 0x40 [0047.303] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\38CkYWeudH.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qdvktojjr\\a0hferbh\\38ckyweudh.gif")) returned 1 [0047.308] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\kqXVmhFl.bmp", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\kqXVmhFl.bmp", lpFilePart=0x0) returned 0x3e [0047.308] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\kqXVmhFl.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qdvktojjr\\a0hferbh\\kqxvmhfl.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.308] GetFileType (hFile=0x398) returned 0x1 [0047.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0047.308] GetFileType (hFile=0x398) returned 0x1 [0047.308] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x4740 [0047.308] ReadFile (in: hFile=0x398, lpBuffer=0x2f4b4a4, nNumberOfBytesToRead=0x4740, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2f4b4a4*, lpNumberOfBytesRead=0x10af2a8*=0x4740, lpOverlapped=0x0) returned 1 [0047.326] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\kqXVmhFl.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\kqXVmhFl.bmp.ForgiveME", lpFilePart=0x0) returned 0x48 [0047.326] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\kqXVmhFl.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qdvktojjr\\a0hferbh\\kqxvmhfl.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.327] GetFileType (hFile=0x398) returned 0x1 [0047.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0047.327] GetFileType (hFile=0x398) returned 0x1 [0047.327] WriteFile (in: hFile=0x398, lpBuffer=0x2fae7e0*, nNumberOfBytesToWrite=0x4750, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2fae7e0*, lpNumberOfBytesWritten=0x10af298*=0x4750, lpOverlapped=0x0) returned 1 [0047.328] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\kqXVmhFl.bmp", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\kqXVmhFl.bmp", lpFilePart=0x0) returned 0x3e [0047.328] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\kqXVmhFl.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qdvktojjr\\a0hferbh\\kqxvmhfl.bmp")) returned 1 [0047.340] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\o gHeJ.jpg", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\o gHeJ.jpg", lpFilePart=0x0) returned 0x3c [0047.340] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\o gHeJ.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qdvktojjr\\a0hferbh\\o ghej.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.341] GetFileType (hFile=0x398) returned 0x1 [0047.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0047.341] GetFileType (hFile=0x398) returned 0x1 [0047.341] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x17b55 [0047.341] ReadFile (in: hFile=0x398, lpBuffer=0x3e930a8, nNumberOfBytesToRead=0x17b55, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x3e930a8*, lpNumberOfBytesRead=0x10af2a8*=0x17b55, lpOverlapped=0x0) returned 1 [0047.359] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\o gHeJ.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\o gHeJ.jpg.ForgiveME", lpFilePart=0x0) returned 0x46 [0047.359] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\o gHeJ.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qdvktojjr\\a0hferbh\\o ghej.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.360] GetFileType (hFile=0x398) returned 0x1 [0047.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0047.360] GetFileType (hFile=0x398) returned 0x1 [0047.360] WriteFile (in: hFile=0x398, lpBuffer=0x3f099c0*, nNumberOfBytesToWrite=0x17b60, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x3f099c0*, lpNumberOfBytesWritten=0x10af298*=0x17b60, lpOverlapped=0x0) returned 1 [0047.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\o gHeJ.jpg", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\o gHeJ.jpg", lpFilePart=0x0) returned 0x3c [0047.361] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\QdvKTojjR\\a0HFerBH\\o gHeJ.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\qdvktojjr\\a0hferbh\\o ghej.jpg")) returned 1 [0047.372] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x2d [0047.372] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\", lpFilePart=0x0) returned 0x2e [0047.372] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c988 [0047.372] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.372] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.372] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0047.372] FindClose (in: hFindFile=0x145c988 | out: hFindFile=0x145c988) returned 1 [0047.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0047.372] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x2d [0047.372] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\", lpFilePart=0x0) returned 0x2e [0047.373] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c8c8 [0047.373] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.373] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.373] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0047.373] FindClose (in: hFindFile=0x145c8c8 | out: hFindFile=0x145c8c8) returned 1 [0047.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0047.373] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2", lpFilePart=0x0) returned 0x31 [0047.373] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\", lpFilePart=0x0) returned 0x32 [0047.373] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c8c8 [0047.373] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.374] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.374] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.374] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.374] FindNextFileW (in: hFindFile=0x145c8c8, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0047.374] FindClose (in: hFindFile=0x145c8c8 | out: hFindFile=0x145c8c8) returned 1 [0047.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0047.374] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2", lpFilePart=0x0) returned 0x31 [0047.374] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\", lpFilePart=0x0) returned 0x32 [0047.374] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145ce88 [0047.374] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.374] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.375] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.375] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.375] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0047.375] FindClose (in: hFindFile=0x145ce88 | out: hFindFile=0x145ce88) returned 1 [0047.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0047.375] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\gXUk6zGjZyC.jpg", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\gXUk6zGjZyC.jpg", lpFilePart=0x0) returned 0x41 [0047.375] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\gXUk6zGjZyC.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\xk7lvjg0smo97yxbi2\\gxuk6zgjzyc.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.375] GetFileType (hFile=0x398) returned 0x1 [0047.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.375] GetFileType (hFile=0x398) returned 0x1 [0047.375] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x14e23 [0047.376] ReadFile (in: hFile=0x398, lpBuffer=0x3f21540, nNumberOfBytesToRead=0x14e23, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x3f21540*, lpNumberOfBytesRead=0x10af2e4*=0x14e23, lpOverlapped=0x0) returned 1 [0047.396] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\gXUk6zGjZyC.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\gXUk6zGjZyC.jpg.ForgiveME", lpFilePart=0x0) returned 0x4b [0047.396] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\gXUk6zGjZyC.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\xk7lvjg0smo97yxbi2\\gxuk6zgjzyc.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.396] GetFileType (hFile=0x398) returned 0x1 [0047.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.396] GetFileType (hFile=0x398) returned 0x1 [0047.396] WriteFile (in: hFile=0x398, lpBuffer=0x3f89c60*, nNumberOfBytesToWrite=0x14e30, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x3f89c60*, lpNumberOfBytesWritten=0x10af2d4*=0x14e30, lpOverlapped=0x0) returned 1 [0047.398] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\gXUk6zGjZyC.jpg", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\gXUk6zGjZyC.jpg", lpFilePart=0x0) returned 0x41 [0047.398] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\gXUk6zGjZyC.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\xk7lvjg0smo97yxbi2\\gxuk6zgjzyc.jpg")) returned 1 [0047.401] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\K0Oi0qu6JV.jpg", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\K0Oi0qu6JV.jpg", lpFilePart=0x0) returned 0x40 [0047.401] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\K0Oi0qu6JV.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\xk7lvjg0smo97yxbi2\\k0oi0qu6jv.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.401] GetFileType (hFile=0x398) returned 0x1 [0047.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.401] GetFileType (hFile=0x398) returned 0x1 [0047.401] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0xc5b3 [0047.401] ReadFile (in: hFile=0x398, lpBuffer=0x2e50dd4, nNumberOfBytesToRead=0xc5b3, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2e50dd4*, lpNumberOfBytesRead=0x10af2e4*=0xc5b3, lpOverlapped=0x0) returned 1 [0047.417] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\K0Oi0qu6JV.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\K0Oi0qu6JV.jpg.ForgiveME", lpFilePart=0x0) returned 0x4a [0047.417] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\K0Oi0qu6JV.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\xk7lvjg0smo97yxbi2\\k0oi0qu6jv.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.417] GetFileType (hFile=0x398) returned 0x1 [0047.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.417] GetFileType (hFile=0x398) returned 0x1 [0047.417] WriteFile (in: hFile=0x398, lpBuffer=0x2ec2f38*, nNumberOfBytesToWrite=0xc5c0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2ec2f38*, lpNumberOfBytesWritten=0x10af2d4*=0xc5c0, lpOverlapped=0x0) returned 1 [0047.419] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\K0Oi0qu6JV.jpg", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\K0Oi0qu6JV.jpg", lpFilePart=0x0) returned 0x40 [0047.419] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\K0Oi0qu6JV.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\xk7lvjg0smo97yxbi2\\k0oi0qu6jv.jpg")) returned 1 [0047.424] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\nXFYUX1LdFo.gif", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\nXFYUX1LdFo.gif", lpFilePart=0x0) returned 0x41 [0047.424] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\nXFYUX1LdFo.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\xk7lvjg0smo97yxbi2\\nxfyux1ldfo.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.424] GetFileType (hFile=0x398) returned 0x1 [0047.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.424] GetFileType (hFile=0x398) returned 0x1 [0047.424] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x10244 [0047.424] ReadFile (in: hFile=0x398, lpBuffer=0x2ecf840, nNumberOfBytesToRead=0x10244, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2ecf840*, lpNumberOfBytesRead=0x10af2e4*=0x10244, lpOverlapped=0x0) returned 1 [0047.441] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\nXFYUX1LdFo.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\nXFYUX1LdFo.gif.ForgiveME", lpFilePart=0x0) returned 0x4b [0047.441] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\nXFYUX1LdFo.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\xk7lvjg0smo97yxbi2\\nxfyux1ldfo.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.442] GetFileType (hFile=0x398) returned 0x1 [0047.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.442] GetFileType (hFile=0x398) returned 0x1 [0047.442] WriteFile (in: hFile=0x398, lpBuffer=0x2f4cdf4*, nNumberOfBytesToWrite=0x10250, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2f4cdf4*, lpNumberOfBytesWritten=0x10af2d4*=0x10250, lpOverlapped=0x0) returned 1 [0047.443] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\nXFYUX1LdFo.gif", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\nXFYUX1LdFo.gif", lpFilePart=0x0) returned 0x41 [0047.443] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\xK7lvJG0Smo97YXbi2\\nXFYUX1LdFo.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\xk7lvjg0smo97yxbi2\\nxfyux1ldfo.gif")) returned 1 [0047.447] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x10aee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0047.447] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", nBufferLength=0x105, lpBuffer=0x10aee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpFilePart=0x0) returned 0x1d [0047.447] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*", lpFindFileData=0x10af0b0 | out: lpFindFileData=0x10af0b0) returned 0x145cd48 [0047.447] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.447] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.448] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.448] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.448] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.448] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.448] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.449] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.449] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.449] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.449] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 0 [0047.449] FindClose (in: hFindFile=0x145cd48 | out: hFindFile=0x145cd48) returned 1 [0047.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af348) returned 1 [0047.449] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x10aee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0047.449] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", nBufferLength=0x105, lpBuffer=0x10aee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\", lpFilePart=0x0) returned 0x1d [0047.449] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*", lpFindFileData=0x10af0b0 | out: lpFindFileData=0x10af0b0) returned 0x145c808 [0047.449] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.450] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.450] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.450] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.450] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.450] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.450] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.450] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.450] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.450] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0047.451] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 0 [0047.451] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0047.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af348) returned 1 [0047.451] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\AAah3NdNBaxj.mp4", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\AAah3NdNBaxj.mp4", lpFilePart=0x0) returned 0x2d [0047.451] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\AAah3NdNBaxj.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\aaah3ndnbaxj.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.451] GetFileType (hFile=0x398) returned 0x1 [0047.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0047.451] GetFileType (hFile=0x398) returned 0x1 [0047.451] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x13639 [0047.451] ReadFile (in: hFile=0x398, lpBuffer=0x2f5f7cc, nNumberOfBytesToRead=0x13639, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f5f7cc*, lpNumberOfBytesRead=0x10af320*=0x13639, lpOverlapped=0x0) returned 1 [0047.467] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\AAah3NdNBaxj.mp4.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\AAah3NdNBaxj.mp4.ForgiveME", lpFilePart=0x0) returned 0x37 [0047.467] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\AAah3NdNBaxj.mp4.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\aaah3ndnbaxj.mp4.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.467] GetFileType (hFile=0x398) returned 0x1 [0047.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0047.467] GetFileType (hFile=0x398) returned 0x1 [0047.467] WriteFile (in: hFile=0x398, lpBuffer=0x2fe692c*, nNumberOfBytesToWrite=0x13640, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fe692c*, lpNumberOfBytesWritten=0x10af310*=0x13640, lpOverlapped=0x0) returned 1 [0047.469] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\AAah3NdNBaxj.mp4", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\AAah3NdNBaxj.mp4", lpFilePart=0x0) returned 0x2d [0047.469] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\AAah3NdNBaxj.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\aaah3ndnbaxj.mp4")) returned 1 [0047.475] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\i70c4 jL.flv", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\i70c4 jL.flv", lpFilePart=0x0) returned 0x29 [0047.475] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\i70c4 jL.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\i70c4 jl.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.475] GetFileType (hFile=0x398) returned 0x1 [0047.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0047.475] GetFileType (hFile=0x398) returned 0x1 [0047.475] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x1e37 [0047.475] ReadFile (in: hFile=0x398, lpBuffer=0x2ffa288, nNumberOfBytesToRead=0x1e37, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ffa288*, lpNumberOfBytesRead=0x10af320*=0x1e37, lpOverlapped=0x0) returned 1 [0047.491] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\i70c4 jL.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\i70c4 jL.flv.ForgiveME", lpFilePart=0x0) returned 0x33 [0047.492] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\i70c4 jL.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\i70c4 jl.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.492] GetFileType (hFile=0x398) returned 0x1 [0047.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0047.492] GetFileType (hFile=0x398) returned 0x1 [0047.492] WriteFile (in: hFile=0x398, lpBuffer=0x2e53224*, nNumberOfBytesToWrite=0x1e40, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e53224*, lpNumberOfBytesWritten=0x10af310*=0x1e40, lpOverlapped=0x0) returned 1 [0047.493] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\i70c4 jL.flv", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\i70c4 jL.flv", lpFilePart=0x0) returned 0x29 [0047.493] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\i70c4 jL.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\i70c4 jl.flv")) returned 1 [0047.503] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\T0bhNVzVYc.mp4", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\T0bhNVzVYc.mp4", lpFilePart=0x0) returned 0x2b [0047.503] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\T0bhNVzVYc.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\t0bhnvzvyc.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.503] GetFileType (hFile=0x398) returned 0x1 [0047.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0047.504] GetFileType (hFile=0x398) returned 0x1 [0047.504] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x10949 [0047.504] ReadFile (in: hFile=0x398, lpBuffer=0x2e5531c, nNumberOfBytesToRead=0x10949, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e5531c*, lpNumberOfBytesRead=0x10af320*=0x10949, lpOverlapped=0x0) returned 1 [0047.520] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\T0bhNVzVYc.mp4.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\T0bhNVzVYc.mp4.ForgiveME", lpFilePart=0x0) returned 0x35 [0047.520] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\T0bhNVzVYc.mp4.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\t0bhnvzvyc.mp4.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.520] GetFileType (hFile=0x398) returned 0x1 [0047.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0047.520] GetFileType (hFile=0x398) returned 0x1 [0047.520] WriteFile (in: hFile=0x398, lpBuffer=0x2ed3f04*, nNumberOfBytesToWrite=0x10950, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2ed3f04*, lpNumberOfBytesWritten=0x10af310*=0x10950, lpOverlapped=0x0) returned 1 [0047.522] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\T0bhNVzVYc.mp4", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\T0bhNVzVYc.mp4", lpFilePart=0x0) returned 0x2b [0047.522] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\T0bhNVzVYc.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\t0bhnvzvyc.mp4")) returned 1 [0047.525] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\TetGFUxS.mp4", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\TetGFUxS.mp4", lpFilePart=0x0) returned 0x29 [0047.525] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\TetGFUxS.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\tetgfuxs.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.526] GetFileType (hFile=0x398) returned 0x1 [0047.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0047.526] GetFileType (hFile=0x398) returned 0x1 [0047.526] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x896b [0047.526] ReadFile (in: hFile=0x398, lpBuffer=0x2ee4b10, nNumberOfBytesToRead=0x896b, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ee4b10*, lpNumberOfBytesRead=0x10af320*=0x896b, lpOverlapped=0x0) returned 1 [0047.540] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\TetGFUxS.mp4.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\TetGFUxS.mp4.ForgiveME", lpFilePart=0x0) returned 0x33 [0047.540] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\TetGFUxS.mp4.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\tetgfuxs.mp4.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.541] GetFileType (hFile=0x398) returned 0x1 [0047.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0047.541] GetFileType (hFile=0x398) returned 0x1 [0047.541] WriteFile (in: hFile=0x398, lpBuffer=0x2f5c8c4*, nNumberOfBytesToWrite=0x8970, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f5c8c4*, lpNumberOfBytesWritten=0x10af310*=0x8970, lpOverlapped=0x0) returned 1 [0047.548] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\TetGFUxS.mp4", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\TetGFUxS.mp4", lpFilePart=0x0) returned 0x29 [0047.549] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\TetGFUxS.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\tetgfuxs.mp4")) returned 1 [0047.551] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\x6R9Ff0rW.swf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\x6R9Ff0rW.swf", lpFilePart=0x0) returned 0x2a [0047.551] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\x6R9Ff0rW.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\x6r9ff0rw.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.551] GetFileType (hFile=0x398) returned 0x1 [0047.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0047.551] GetFileType (hFile=0x398) returned 0x1 [0047.551] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x64eb [0047.551] ReadFile (in: hFile=0x398, lpBuffer=0x2f654e8, nNumberOfBytesToRead=0x64eb, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f654e8*, lpNumberOfBytesRead=0x10af320*=0x64eb, lpOverlapped=0x0) returned 1 [0047.567] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\x6R9Ff0rW.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\x6R9Ff0rW.swf.ForgiveME", lpFilePart=0x0) returned 0x34 [0047.567] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\x6R9Ff0rW.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\x6r9ff0rw.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.567] GetFileType (hFile=0x398) returned 0x1 [0047.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0047.567] GetFileType (hFile=0x398) returned 0x1 [0047.567] WriteFile (in: hFile=0x398, lpBuffer=0x2fd1c20*, nNumberOfBytesToWrite=0x64f0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fd1c20*, lpNumberOfBytesWritten=0x10af310*=0x64f0, lpOverlapped=0x0) returned 1 [0047.568] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\x6R9Ff0rW.swf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\x6R9Ff0rW.swf", lpFilePart=0x0) returned 0x2a [0047.568] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\x6R9Ff0rW.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\x6r9ff0rw.swf")) returned 1 [0047.569] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ZsnT4CE2i.swf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ZsnT4CE2i.swf", lpFilePart=0x0) returned 0x2a [0047.569] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ZsnT4CE2i.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\zsnt4ce2i.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.569] GetFileType (hFile=0x398) returned 0x1 [0047.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0047.569] GetFileType (hFile=0x398) returned 0x1 [0047.569] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x10049 [0047.569] ReadFile (in: hFile=0x398, lpBuffer=0x2fd83cc, nNumberOfBytesToRead=0x10049, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2fd83cc*, lpNumberOfBytesRead=0x10af320*=0x10049, lpOverlapped=0x0) returned 1 [0047.587] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ZsnT4CE2i.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ZsnT4CE2i.swf.ForgiveME", lpFilePart=0x0) returned 0x34 [0047.587] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ZsnT4CE2i.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\zsnt4ce2i.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.587] GetFileType (hFile=0x398) returned 0x1 [0047.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0047.587] GetFileType (hFile=0x398) returned 0x1 [0047.587] WriteFile (in: hFile=0x398, lpBuffer=0x2e697fc*, nNumberOfBytesToWrite=0x10050, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e697fc*, lpNumberOfBytesWritten=0x10af310*=0x10050, lpOverlapped=0x0) returned 1 [0047.589] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ZsnT4CE2i.swf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ZsnT4CE2i.swf", lpFilePart=0x0) returned 0x2a [0047.589] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\ZsnT4CE2i.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\zsnt4ce2i.swf")) returned 1 [0047.591] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_Q-erkcMEj49z d2se8u.flv", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_Q-erkcMEj49z d2se8u.flv", lpFilePart=0x0) returned 0x35 [0047.591] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_Q-erkcMEj49z d2se8u.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_q-erkcmej49z d2se8u.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.591] GetFileType (hFile=0x398) returned 0x1 [0047.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0047.591] GetFileType (hFile=0x398) returned 0x1 [0047.591] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xc5dd [0047.591] ReadFile (in: hFile=0x398, lpBuffer=0x2e79b34, nNumberOfBytesToRead=0xc5dd, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e79b34*, lpNumberOfBytesRead=0x10af320*=0xc5dd, lpOverlapped=0x0) returned 1 [0047.606] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_Q-erkcMEj49z d2se8u.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_Q-erkcMEj49z d2se8u.flv.ForgiveME", lpFilePart=0x0) returned 0x3f [0047.606] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_Q-erkcMEj49z d2se8u.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_q-erkcmej49z d2se8u.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.606] GetFileType (hFile=0x398) returned 0x1 [0047.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0047.606] GetFileType (hFile=0x398) returned 0x1 [0047.606] WriteFile (in: hFile=0x398, lpBuffer=0x2eebce0*, nNumberOfBytesToWrite=0xc5e0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2eebce0*, lpNumberOfBytesWritten=0x10af310*=0xc5e0, lpOverlapped=0x0) returned 1 [0047.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_Q-erkcMEj49z d2se8u.flv", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_Q-erkcMEj49z d2se8u.flv", lpFilePart=0x0) returned 0x35 [0047.607] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_Q-erkcMEj49z d2se8u.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_q-erkcmej49z d2se8u.flv")) returned 1 [0047.609] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL", lpFilePart=0x0) returned 0x29 [0047.609] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\", lpFilePart=0x0) returned 0x2a [0047.610] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145cb08 [0047.610] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.610] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.610] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.610] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.610] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.610] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.610] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.610] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.610] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0047.611] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0047.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0047.611] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL", lpFilePart=0x0) returned 0x29 [0047.611] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\", lpFilePart=0x0) returned 0x2a [0047.611] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145cb88 [0047.611] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.611] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0047.612] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0047.612] FindClose (in: hFindFile=0x145cb88 | out: hFindFile=0x145cb88) returned 1 [0047.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0047.612] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\-9k1Pp.flv", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\-9k1Pp.flv", lpFilePart=0x0) returned 0x34 [0047.612] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\-9k1Pp.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\-9k1pp.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.612] GetFileType (hFile=0x398) returned 0x1 [0047.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.612] GetFileType (hFile=0x398) returned 0x1 [0047.612] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x6045 [0047.612] ReadFile (in: hFile=0x398, lpBuffer=0x2efb700, nNumberOfBytesToRead=0x6045, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2efb700*, lpNumberOfBytesRead=0x10af2e4*=0x6045, lpOverlapped=0x0) returned 1 [0047.646] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\-9k1Pp.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\-9k1Pp.flv.ForgiveME", lpFilePart=0x0) returned 0x3e [0047.646] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\-9k1Pp.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\-9k1pp.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.647] GetFileType (hFile=0x398) returned 0x1 [0047.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.647] GetFileType (hFile=0x398) returned 0x1 [0047.647] WriteFile (in: hFile=0x398, lpBuffer=0x2f6672c*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2f6672c*, lpNumberOfBytesWritten=0x10af2d4*=0x6050, lpOverlapped=0x0) returned 1 [0047.648] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\-9k1Pp.flv", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\-9k1Pp.flv", lpFilePart=0x0) returned 0x34 [0047.648] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\-9k1Pp.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\-9k1pp.flv")) returned 1 [0047.652] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\4tHxHXTTn_.swf", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\4tHxHXTTn_.swf", lpFilePart=0x0) returned 0x38 [0047.652] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\4tHxHXTTn_.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\4thxhxttn_.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.652] GetFileType (hFile=0x398) returned 0x1 [0047.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.652] GetFileType (hFile=0x398) returned 0x1 [0047.652] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x15d6f [0047.653] ReadFile (in: hFile=0x398, lpBuffer=0x4058650, nNumberOfBytesToRead=0x15d6f, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x4058650*, lpNumberOfBytesRead=0x10af2e4*=0x15d6f, lpOverlapped=0x0) returned 1 [0047.670] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\4tHxHXTTn_.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\4tHxHXTTn_.swf.ForgiveME", lpFilePart=0x0) returned 0x42 [0047.670] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\4tHxHXTTn_.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\4thxhxttn_.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.671] GetFileType (hFile=0x398) returned 0x1 [0047.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.671] GetFileType (hFile=0x398) returned 0x1 [0047.671] WriteFile (in: hFile=0x398, lpBuffer=0x40c59c0*, nNumberOfBytesToWrite=0x15d70, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x40c59c0*, lpNumberOfBytesWritten=0x10af2d4*=0x15d70, lpOverlapped=0x0) returned 1 [0047.672] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\4tHxHXTTn_.swf", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\4tHxHXTTn_.swf", lpFilePart=0x0) returned 0x38 [0047.672] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\4tHxHXTTn_.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\4thxhxttn_.swf")) returned 1 [0047.674] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\atxemqhw.flv", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\atxemqhw.flv", lpFilePart=0x0) returned 0x36 [0047.674] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\atxemqhw.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\atxemqhw.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.674] GetFileType (hFile=0x398) returned 0x1 [0047.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.674] GetFileType (hFile=0x398) returned 0x1 [0047.674] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x16a96 [0047.674] ReadFile (in: hFile=0x398, lpBuffer=0x411c4c8, nNumberOfBytesToRead=0x16a96, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x411c4c8*, lpNumberOfBytesRead=0x10af2e4*=0x16a96, lpOverlapped=0x0) returned 1 [0047.695] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\atxemqhw.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\atxemqhw.flv.ForgiveME", lpFilePart=0x0) returned 0x40 [0047.695] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\atxemqhw.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\atxemqhw.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.696] GetFileType (hFile=0x398) returned 0x1 [0047.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.696] GetFileType (hFile=0x398) returned 0x1 [0047.696] WriteFile (in: hFile=0x398, lpBuffer=0x3e3d8c0*, nNumberOfBytesToWrite=0x16aa0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x3e3d8c0*, lpNumberOfBytesWritten=0x10af2d4*=0x16aa0, lpOverlapped=0x0) returned 1 [0047.697] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\atxemqhw.flv", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\atxemqhw.flv", lpFilePart=0x0) returned 0x36 [0047.698] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\atxemqhw.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\atxemqhw.flv")) returned 1 [0047.699] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\aVDOWsEaj8PL.mp4", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\aVDOWsEaj8PL.mp4", lpFilePart=0x0) returned 0x3a [0047.700] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\aVDOWsEaj8PL.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\avdowseaj8pl.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.700] GetFileType (hFile=0x398) returned 0x1 [0047.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.700] GetFileType (hFile=0x398) returned 0x1 [0047.700] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x13e45 [0047.700] ReadFile (in: hFile=0x398, lpBuffer=0x2e06d70, nNumberOfBytesToRead=0x13e45, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2e06d70*, lpNumberOfBytesRead=0x10af2e4*=0x13e45, lpOverlapped=0x0) returned 1 [0047.716] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\aVDOWsEaj8PL.mp4.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\aVDOWsEaj8PL.mp4.ForgiveME", lpFilePart=0x0) returned 0x44 [0047.716] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\aVDOWsEaj8PL.mp4.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\avdowseaj8pl.mp4.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.716] GetFileType (hFile=0x398) returned 0x1 [0047.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.716] GetFileType (hFile=0x398) returned 0x1 [0047.716] WriteFile (in: hFile=0x398, lpBuffer=0x2e8f878*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2e8f878*, lpNumberOfBytesWritten=0x10af2d4*=0x13e50, lpOverlapped=0x0) returned 1 [0047.718] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\aVDOWsEaj8PL.mp4", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\aVDOWsEaj8PL.mp4", lpFilePart=0x0) returned 0x3a [0047.718] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\aVDOWsEaj8PL.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\avdowseaj8pl.mp4")) returned 1 [0047.728] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\Dyrf.swf", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\Dyrf.swf", lpFilePart=0x0) returned 0x32 [0047.728] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\Dyrf.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\dyrf.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.728] GetFileType (hFile=0x398) returned 0x1 [0047.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.728] GetFileType (hFile=0x398) returned 0x1 [0047.728] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0xadcf [0047.728] ReadFile (in: hFile=0x398, lpBuffer=0x2ea39d4, nNumberOfBytesToRead=0xadcf, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2ea39d4*, lpNumberOfBytesRead=0x10af2e4*=0xadcf, lpOverlapped=0x0) returned 1 [0047.744] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\Dyrf.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\Dyrf.swf.ForgiveME", lpFilePart=0x0) returned 0x3c [0047.744] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\Dyrf.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\dyrf.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.745] GetFileType (hFile=0x398) returned 0x1 [0047.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.745] GetFileType (hFile=0x398) returned 0x1 [0047.745] WriteFile (in: hFile=0x398, lpBuffer=0x2f111f0*, nNumberOfBytesToWrite=0xadd0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2f111f0*, lpNumberOfBytesWritten=0x10af2d4*=0xadd0, lpOverlapped=0x0) returned 1 [0047.746] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\Dyrf.swf", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\Dyrf.swf", lpFilePart=0x0) returned 0x32 [0047.746] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\Dyrf.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\dyrf.swf")) returned 1 [0047.747] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\g8J7qL XZbbi3Xz7Ub.flv", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\g8J7qL XZbbi3Xz7Ub.flv", lpFilePart=0x0) returned 0x40 [0047.747] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\g8J7qL XZbbi3Xz7Ub.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\g8j7ql xzbbi3xz7ub.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.747] GetFileType (hFile=0x398) returned 0x1 [0047.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.747] GetFileType (hFile=0x398) returned 0x1 [0047.747] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x10a1b [0047.747] ReadFile (in: hFile=0x398, lpBuffer=0x2f1c2d4, nNumberOfBytesToRead=0x10a1b, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2f1c2d4*, lpNumberOfBytesRead=0x10af2e4*=0x10a1b, lpOverlapped=0x0) returned 1 [0047.763] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\g8J7qL XZbbi3Xz7Ub.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\g8J7qL XZbbi3Xz7Ub.flv.ForgiveME", lpFilePart=0x0) returned 0x4a [0047.763] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\g8J7qL XZbbi3Xz7Ub.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\g8j7ql xzbbi3xz7ub.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.763] GetFileType (hFile=0x398) returned 0x1 [0047.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.763] GetFileType (hFile=0x398) returned 0x1 [0047.763] WriteFile (in: hFile=0x398, lpBuffer=0x2f9affc*, nNumberOfBytesToWrite=0x10a20, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2f9affc*, lpNumberOfBytesWritten=0x10af2d4*=0x10a20, lpOverlapped=0x0) returned 1 [0047.765] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\g8J7qL XZbbi3Xz7Ub.flv", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\g8J7qL XZbbi3Xz7Ub.flv", lpFilePart=0x0) returned 0x40 [0047.765] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\g8J7qL XZbbi3Xz7Ub.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\g8j7ql xzbbi3xz7ub.flv")) returned 1 [0047.775] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\iA9Xe-aPj5db.avi", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\iA9Xe-aPj5db.avi", lpFilePart=0x0) returned 0x3a [0047.775] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\iA9Xe-aPj5db.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\ia9xe-apj5db.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.775] GetFileType (hFile=0x398) returned 0x1 [0047.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.775] GetFileType (hFile=0x398) returned 0x1 [0047.777] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x138d0 [0047.777] ReadFile (in: hFile=0x398, lpBuffer=0x2fabd6c, nNumberOfBytesToRead=0x138d0, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2fabd6c*, lpNumberOfBytesRead=0x10af2e4*=0x138d0, lpOverlapped=0x0) returned 1 [0047.794] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\iA9Xe-aPj5db.avi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\iA9Xe-aPj5db.avi.ForgiveME", lpFilePart=0x0) returned 0x44 [0047.794] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\iA9Xe-aPj5db.avi.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\ia9xe-apj5db.avi.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.795] GetFileType (hFile=0x398) returned 0x1 [0047.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.795] GetFileType (hFile=0x398) returned 0x1 [0047.795] WriteFile (in: hFile=0x398, lpBuffer=0x2e476e4*, nNumberOfBytesToWrite=0x138e0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2e476e4*, lpNumberOfBytesWritten=0x10af2d4*=0x138e0, lpOverlapped=0x0) returned 1 [0047.796] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\iA9Xe-aPj5db.avi", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\iA9Xe-aPj5db.avi", lpFilePart=0x0) returned 0x3a [0047.796] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\iA9Xe-aPj5db.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\ia9xe-apj5db.avi")) returned 1 [0047.800] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\JJdT3P6bu5i.flv", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\JJdT3P6bu5i.flv", lpFilePart=0x0) returned 0x39 [0047.800] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\JJdT3P6bu5i.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\jjdt3p6bu5i.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.800] GetFileType (hFile=0x398) returned 0x1 [0047.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.800] GetFileType (hFile=0x398) returned 0x1 [0047.800] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x3c94 [0047.800] ReadFile (in: hFile=0x398, lpBuffer=0x2e5b2e8, nNumberOfBytesToRead=0x3c94, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2e5b2e8*, lpNumberOfBytesRead=0x10af2e4*=0x3c94, lpOverlapped=0x0) returned 1 [0047.814] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\JJdT3P6bu5i.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\JJdT3P6bu5i.flv.ForgiveME", lpFilePart=0x0) returned 0x43 [0047.815] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\JJdT3P6bu5i.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\jjdt3p6bu5i.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.815] GetFileType (hFile=0x398) returned 0x1 [0047.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.815] GetFileType (hFile=0x398) returned 0x1 [0047.815] WriteFile (in: hFile=0x398, lpBuffer=0x2ebb204*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2ebb204*, lpNumberOfBytesWritten=0x10af2d4*=0x3ca0, lpOverlapped=0x0) returned 1 [0047.816] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\JJdT3P6bu5i.flv", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\JJdT3P6bu5i.flv", lpFilePart=0x0) returned 0x39 [0047.816] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\JJdT3P6bu5i.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\jjdt3p6bu5i.flv")) returned 1 [0047.826] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\ldIDPJKczA_q8p.mkv", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\ldIDPJKczA_q8p.mkv", lpFilePart=0x0) returned 0x3c [0047.826] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\ldIDPJKczA_q8p.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\ldidpjkcza_q8p.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.826] GetFileType (hFile=0x398) returned 0x1 [0047.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.826] GetFileType (hFile=0x398) returned 0x1 [0047.826] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x16209 [0047.827] ReadFile (in: hFile=0x398, lpBuffer=0x3eda1c0, nNumberOfBytesToRead=0x16209, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x3eda1c0*, lpNumberOfBytesRead=0x10af2e4*=0x16209, lpOverlapped=0x0) returned 1 [0047.842] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\ldIDPJKczA_q8p.mkv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\ldIDPJKczA_q8p.mkv.ForgiveME", lpFilePart=0x0) returned 0x46 [0047.842] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\ldIDPJKczA_q8p.mkv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\ldidpjkcza_q8p.mkv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.843] GetFileType (hFile=0x398) returned 0x1 [0047.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.843] GetFileType (hFile=0x398) returned 0x1 [0047.843] WriteFile (in: hFile=0x398, lpBuffer=0x3f48c48*, nNumberOfBytesToWrite=0x16210, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x3f48c48*, lpNumberOfBytesWritten=0x10af2d4*=0x16210, lpOverlapped=0x0) returned 1 [0047.844] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\ldIDPJKczA_q8p.mkv", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\ldIDPJKczA_q8p.mkv", lpFilePart=0x0) returned 0x3c [0047.844] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\ldIDPJKczA_q8p.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\ldidpjkcza_q8p.mkv")) returned 1 [0047.847] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\o19yd3KxSY3.flv", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\o19yd3KxSY3.flv", lpFilePart=0x0) returned 0x39 [0047.847] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\o19yd3KxSY3.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\o19yd3kxsy3.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.848] GetFileType (hFile=0x398) returned 0x1 [0047.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0047.848] GetFileType (hFile=0x398) returned 0x1 [0047.848] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x10a7 [0047.848] ReadFile (in: hFile=0x398, lpBuffer=0x2f0c3b0, nNumberOfBytesToRead=0x10a7, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2f0c3b0*, lpNumberOfBytesRead=0x10af2e4*=0x10a7, lpOverlapped=0x0) returned 1 [0047.863] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\o19yd3KxSY3.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\o19yd3KxSY3.flv.ForgiveME", lpFilePart=0x0) returned 0x43 [0047.863] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\o19yd3KxSY3.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\o19yd3kxsy3.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.864] GetFileType (hFile=0x398) returned 0x1 [0047.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0047.864] GetFileType (hFile=0x398) returned 0x1 [0047.864] WriteFile (in: hFile=0x398, lpBuffer=0x2f5e5c4*, nNumberOfBytesToWrite=0x10b0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2f5e5c4*, lpNumberOfBytesWritten=0x10af2d4*=0x10b0, lpOverlapped=0x0) returned 1 [0047.865] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\o19yd3KxSY3.flv", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\o19yd3KxSY3.flv", lpFilePart=0x0) returned 0x39 [0047.865] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\o19yd3KxSY3.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\o19yd3kxsy3.flv")) returned 1 [0047.871] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz", lpFilePart=0x0) returned 0x3c [0047.871] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\", lpFilePart=0x0) returned 0x3d [0047.872] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cb48 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.872] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0047.872] FindClose (in: hFindFile=0x145cb48 | out: hFindFile=0x145cb48) returned 1 [0047.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0047.872] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz", lpFilePart=0x0) returned 0x3c [0047.872] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\", lpFilePart=0x0) returned 0x3d [0047.873] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c888 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0047.873] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0047.873] FindClose (in: hFindFile=0x145c888 | out: hFindFile=0x145c888) returned 1 [0047.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0047.873] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\4_rAxaFg1.swf", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\4_rAxaFg1.swf", lpFilePart=0x0) returned 0x4a [0047.873] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\4_rAxaFg1.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\4_raxafg1.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.873] GetFileType (hFile=0x398) returned 0x1 [0047.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0047.873] GetFileType (hFile=0x398) returned 0x1 [0047.874] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x13f0c [0047.874] ReadFile (in: hFile=0x398, lpBuffer=0x2f63600, nNumberOfBytesToRead=0x13f0c, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2f63600*, lpNumberOfBytesRead=0x10af2a8*=0x13f0c, lpOverlapped=0x0) returned 1 [0047.891] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\4_rAxaFg1.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\4_rAxaFg1.swf.ForgiveME", lpFilePart=0x0) returned 0x54 [0047.891] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\4_rAxaFg1.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\4_raxafg1.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.891] GetFileType (hFile=0x398) returned 0x1 [0047.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0047.891] GetFileType (hFile=0x398) returned 0x1 [0047.891] WriteFile (in: hFile=0x398, lpBuffer=0x2fec208*, nNumberOfBytesToWrite=0x13f10, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2fec208*, lpNumberOfBytesWritten=0x10af298*=0x13f10, lpOverlapped=0x0) returned 1 [0047.893] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\4_rAxaFg1.swf", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\4_rAxaFg1.swf", lpFilePart=0x0) returned 0x4a [0047.893] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\4_rAxaFg1.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\4_raxafg1.swf")) returned 1 [0047.894] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\A5Ar0nVRt__m.mp4", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\A5Ar0nVRt__m.mp4", lpFilePart=0x0) returned 0x4d [0047.894] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\A5Ar0nVRt__m.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\a5ar0nvrt__m.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.894] GetFileType (hFile=0x398) returned 0x1 [0047.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0047.894] GetFileType (hFile=0x398) returned 0x1 [0047.894] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x7070 [0047.894] ReadFile (in: hFile=0x398, lpBuffer=0x30004a0, nNumberOfBytesToRead=0x7070, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x30004a0*, lpNumberOfBytesRead=0x10af2a8*=0x7070, lpOverlapped=0x0) returned 1 [0047.910] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\A5Ar0nVRt__m.mp4.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\A5Ar0nVRt__m.mp4.ForgiveME", lpFilePart=0x0) returned 0x57 [0047.910] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\A5Ar0nVRt__m.mp4.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\a5ar0nvrt__m.mp4.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.911] GetFileType (hFile=0x398) returned 0x1 [0047.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0047.911] GetFileType (hFile=0x398) returned 0x1 [0047.911] WriteFile (in: hFile=0x398, lpBuffer=0x2e785bc*, nNumberOfBytesToWrite=0x7080, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2e785bc*, lpNumberOfBytesWritten=0x10af298*=0x7080, lpOverlapped=0x0) returned 1 [0047.912] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\A5Ar0nVRt__m.mp4", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\A5Ar0nVRt__m.mp4", lpFilePart=0x0) returned 0x4d [0047.912] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\A5Ar0nVRt__m.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\a5ar0nvrt__m.mp4")) returned 1 [0047.913] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\aCMrQM_63.mkv", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\aCMrQM_63.mkv", lpFilePart=0x0) returned 0x4a [0047.913] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\aCMrQM_63.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\acmrqm_63.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.914] GetFileType (hFile=0x398) returned 0x1 [0047.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0047.914] GetFileType (hFile=0x398) returned 0x1 [0047.914] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x98af [0047.914] ReadFile (in: hFile=0x398, lpBuffer=0x2e7f9c8, nNumberOfBytesToRead=0x98af, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2e7f9c8*, lpNumberOfBytesRead=0x10af2a8*=0x98af, lpOverlapped=0x0) returned 1 [0047.935] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\aCMrQM_63.mkv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\aCMrQM_63.mkv.ForgiveME", lpFilePart=0x0) returned 0x54 [0047.935] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\aCMrQM_63.mkv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\acmrqm_63.mkv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.935] GetFileType (hFile=0x398) returned 0x1 [0047.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0047.935] GetFileType (hFile=0x398) returned 0x1 [0047.935] WriteFile (in: hFile=0x398, lpBuffer=0x2efc55c*, nNumberOfBytesToWrite=0x98b0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2efc55c*, lpNumberOfBytesWritten=0x10af298*=0x98b0, lpOverlapped=0x0) returned 1 [0047.936] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\aCMrQM_63.mkv", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\aCMrQM_63.mkv", lpFilePart=0x0) returned 0x4a [0047.936] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\aCMrQM_63.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\acmrqm_63.mkv")) returned 1 [0047.941] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\caJUViiH8J-NNmdDGq.mkv", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\caJUViiH8J-NNmdDGq.mkv", lpFilePart=0x0) returned 0x53 [0047.942] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\caJUViiH8J-NNmdDGq.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\cajuviih8j-nnmddgq.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.942] GetFileType (hFile=0x398) returned 0x1 [0047.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0047.942] GetFileType (hFile=0x398) returned 0x1 [0047.942] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x85e9 [0047.942] ReadFile (in: hFile=0x398, lpBuffer=0x2f061ac, nNumberOfBytesToRead=0x85e9, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2f061ac*, lpNumberOfBytesRead=0x10af2a8*=0x85e9, lpOverlapped=0x0) returned 1 [0047.957] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\caJUViiH8J-NNmdDGq.mkv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\caJUViiH8J-NNmdDGq.mkv.ForgiveME", lpFilePart=0x0) returned 0x5d [0047.957] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\caJUViiH8J-NNmdDGq.mkv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\cajuviih8j-nnmddgq.mkv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.958] GetFileType (hFile=0x398) returned 0x1 [0047.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0047.958] GetFileType (hFile=0x398) returned 0x1 [0047.958] WriteFile (in: hFile=0x398, lpBuffer=0x2f7ce34*, nNumberOfBytesToWrite=0x85f0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2f7ce34*, lpNumberOfBytesWritten=0x10af298*=0x85f0, lpOverlapped=0x0) returned 1 [0047.959] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\caJUViiH8J-NNmdDGq.mkv", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\caJUViiH8J-NNmdDGq.mkv", lpFilePart=0x0) returned 0x53 [0047.959] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\caJUViiH8J-NNmdDGq.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\cajuviih8j-nnmddgq.mkv")) returned 1 [0047.962] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\F8gFrq6IWg-T.flv", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\F8gFrq6IWg-T.flv", lpFilePart=0x0) returned 0x4d [0047.962] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\F8gFrq6IWg-T.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\f8gfrq6iwg-t.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.962] GetFileType (hFile=0x398) returned 0x1 [0047.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0047.962] GetFileType (hFile=0x398) returned 0x1 [0047.962] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x11df7 [0047.963] ReadFile (in: hFile=0x398, lpBuffer=0x2f857e0, nNumberOfBytesToRead=0x11df7, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2f857e0*, lpNumberOfBytesRead=0x10af2a8*=0x11df7, lpOverlapped=0x0) returned 1 [0047.978] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\F8gFrq6IWg-T.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\F8gFrq6IWg-T.flv.ForgiveME", lpFilePart=0x0) returned 0x57 [0047.978] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\F8gFrq6IWg-T.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\f8gfrq6iwg-t.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.978] GetFileType (hFile=0x398) returned 0x1 [0047.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0047.978] GetFileType (hFile=0x398) returned 0x1 [0047.978] WriteFile (in: hFile=0x398, lpBuffer=0x30080c0*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x30080c0*, lpNumberOfBytesWritten=0x10af298*=0x11e00, lpOverlapped=0x0) returned 1 [0047.980] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\F8gFrq6IWg-T.flv", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\F8gFrq6IWg-T.flv", lpFilePart=0x0) returned 0x4d [0047.980] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\F8gFrq6IWg-T.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\f8gfrq6iwg-t.flv")) returned 1 [0047.987] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\IUW6-rLdvTO6DR2.flv", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\IUW6-rLdvTO6DR2.flv", lpFilePart=0x0) returned 0x50 [0047.987] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\IUW6-rLdvTO6DR2.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\iuw6-rldvto6dr2.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0047.987] GetFileType (hFile=0x398) returned 0x1 [0047.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0047.987] GetFileType (hFile=0x398) returned 0x1 [0047.987] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0xae21 [0047.987] ReadFile (in: hFile=0x398, lpBuffer=0x301a264, nNumberOfBytesToRead=0xae21, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x301a264*, lpNumberOfBytesRead=0x10af2a8*=0xae21, lpOverlapped=0x0) returned 1 [0048.033] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\IUW6-rLdvTO6DR2.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\IUW6-rLdvTO6DR2.flv.ForgiveME", lpFilePart=0x0) returned 0x5a [0048.034] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\IUW6-rLdvTO6DR2.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\iuw6-rldvto6dr2.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.035] GetFileType (hFile=0x398) returned 0x1 [0048.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0048.035] GetFileType (hFile=0x398) returned 0x1 [0048.035] WriteFile (in: hFile=0x398, lpBuffer=0x2e9e178*, nNumberOfBytesToWrite=0xae30, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2e9e178*, lpNumberOfBytesWritten=0x10af298*=0xae30, lpOverlapped=0x0) returned 1 [0048.036] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\IUW6-rLdvTO6DR2.flv", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\IUW6-rLdvTO6DR2.flv", lpFilePart=0x0) returned 0x50 [0048.036] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\IUW6-rLdvTO6DR2.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\iuw6-rldvto6dr2.flv")) returned 1 [0048.047] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\KNPt4Gm.flv", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\KNPt4Gm.flv", lpFilePart=0x0) returned 0x48 [0048.047] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\KNPt4Gm.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\knpt4gm.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.047] GetFileType (hFile=0x398) returned 0x1 [0048.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0048.047] GetFileType (hFile=0x398) returned 0x1 [0048.047] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x5edd [0048.047] ReadFile (in: hFile=0x398, lpBuffer=0x2ea9340, nNumberOfBytesToRead=0x5edd, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2ea9340*, lpNumberOfBytesRead=0x10af2a8*=0x5edd, lpOverlapped=0x0) returned 1 [0048.064] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\KNPt4Gm.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\KNPt4Gm.flv.ForgiveME", lpFilePart=0x0) returned 0x52 [0048.064] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\KNPt4Gm.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\knpt4gm.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.064] GetFileType (hFile=0x398) returned 0x1 [0048.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0048.064] GetFileType (hFile=0x398) returned 0x1 [0048.064] WriteFile (in: hFile=0x398, lpBuffer=0x2f13dc0*, nNumberOfBytesToWrite=0x5ee0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2f13dc0*, lpNumberOfBytesWritten=0x10af298*=0x5ee0, lpOverlapped=0x0) returned 1 [0048.065] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\KNPt4Gm.flv", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\KNPt4Gm.flv", lpFilePart=0x0) returned 0x48 [0048.065] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\KNPt4Gm.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\knpt4gm.flv")) returned 1 [0048.067] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\TctoFGOt_9l.flv", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\TctoFGOt_9l.flv", lpFilePart=0x0) returned 0x4c [0048.067] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\TctoFGOt_9l.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\tctofgot_9l.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.067] GetFileType (hFile=0x398) returned 0x1 [0048.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0048.067] GetFileType (hFile=0x398) returned 0x1 [0048.067] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x2b08 [0048.067] ReadFile (in: hFile=0x398, lpBuffer=0x2f1a018, nNumberOfBytesToRead=0x2b08, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2f1a018*, lpNumberOfBytesRead=0x10af2a8*=0x2b08, lpOverlapped=0x0) returned 1 [0048.081] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\TctoFGOt_9l.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\TctoFGOt_9l.flv.ForgiveME", lpFilePart=0x0) returned 0x56 [0048.081] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\TctoFGOt_9l.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\tctofgot_9l.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.082] GetFileType (hFile=0x398) returned 0x1 [0048.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0048.082] GetFileType (hFile=0x398) returned 0x1 [0048.082] WriteFile (in: hFile=0x398, lpBuffer=0x2f74630*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2f74630*, lpNumberOfBytesWritten=0x10af298*=0x2b10, lpOverlapped=0x0) returned 1 [0048.083] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\TctoFGOt_9l.flv", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\TctoFGOt_9l.flv", lpFilePart=0x0) returned 0x4c [0048.083] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\TctoFGOt_9l.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\tctofgot_9l.flv")) returned 1 [0048.084] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\v zXqlE7_5RW0Ol.swf", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\v zXqlE7_5RW0Ol.swf", lpFilePart=0x0) returned 0x50 [0048.084] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\v zXqlE7_5RW0Ol.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\v zxqle7_5rw0ol.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.085] GetFileType (hFile=0x398) returned 0x1 [0048.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0048.085] GetFileType (hFile=0x398) returned 0x1 [0048.085] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x1b3b [0048.085] ReadFile (in: hFile=0x398, lpBuffer=0x2f774e0, nNumberOfBytesToRead=0x1b3b, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2f774e0*, lpNumberOfBytesRead=0x10af2a8*=0x1b3b, lpOverlapped=0x0) returned 1 [0048.098] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\v zXqlE7_5RW0Ol.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\v zXqlE7_5RW0Ol.swf.ForgiveME", lpFilePart=0x0) returned 0x5a [0048.098] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\v zXqlE7_5RW0Ol.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\v zxqle7_5rw0ol.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.099] GetFileType (hFile=0x398) returned 0x1 [0048.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0048.099] GetFileType (hFile=0x398) returned 0x1 [0048.099] WriteFile (in: hFile=0x398, lpBuffer=0x2fccbf4*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2fccbf4*, lpNumberOfBytesWritten=0x10af298*=0x1b40, lpOverlapped=0x0) returned 1 [0048.102] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\v zXqlE7_5RW0Ol.swf", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\v zXqlE7_5RW0Ol.swf", lpFilePart=0x0) returned 0x50 [0048.102] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\v zXqlE7_5RW0Ol.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\v zxqle7_5rw0ol.swf")) returned 1 [0048.103] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\z_9nlp1Ozu.swf", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\z_9nlp1Ozu.swf", lpFilePart=0x0) returned 0x4b [0048.103] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\z_9nlp1Ozu.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\z_9nlp1ozu.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.103] GetFileType (hFile=0x398) returned 0x1 [0048.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0048.103] GetFileType (hFile=0x398) returned 0x1 [0048.103] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x85aa [0048.103] ReadFile (in: hFile=0x398, lpBuffer=0x2fcead8, nNumberOfBytesToRead=0x85aa, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2fcead8*, lpNumberOfBytesRead=0x10af2a8*=0x85aa, lpOverlapped=0x0) returned 1 [0048.126] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\z_9nlp1Ozu.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\z_9nlp1Ozu.swf.ForgiveME", lpFilePart=0x0) returned 0x55 [0048.126] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\z_9nlp1Ozu.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\z_9nlp1ozu.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.126] GetFileType (hFile=0x398) returned 0x1 [0048.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0048.126] GetFileType (hFile=0x398) returned 0x1 [0048.126] WriteFile (in: hFile=0x398, lpBuffer=0x2e4ce08*, nNumberOfBytesToWrite=0x85b0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2e4ce08*, lpNumberOfBytesWritten=0x10af298*=0x85b0, lpOverlapped=0x0) returned 1 [0048.127] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\z_9nlp1Ozu.swf", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\z_9nlp1Ozu.swf", lpFilePart=0x0) returned 0x4b [0048.127] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\z_9nlp1Ozu.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\z_9nlp1ozu.swf")) returned 1 [0048.128] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok", lpFilePart=0x0) returned 0x47 [0048.128] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\", lpFilePart=0x0) returned 0x48 [0048.128] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb88 [0048.128] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.128] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.128] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.128] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0048.129] FindClose (in: hFindFile=0x145cb88 | out: hFindFile=0x145cb88) returned 1 [0048.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0048.129] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok", lpFilePart=0x0) returned 0x47 [0048.129] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\", lpFilePart=0x0) returned 0x48 [0048.129] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c9c8 [0048.129] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0048.129] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0048.129] FindClose (in: hFindFile=0x145c9c8 | out: hFindFile=0x145c9c8) returned 1 [0048.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0048.130] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\02cYYkEK8IzC.swf", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\02cYYkEK8IzC.swf", lpFilePart=0x0) returned 0x58 [0048.130] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\02cYYkEK8IzC.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\02cyykek8izc.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.130] GetFileType (hFile=0x398) returned 0x1 [0048.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0048.130] GetFileType (hFile=0x398) returned 0x1 [0048.130] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0xc731 [0048.130] ReadFile (in: hFile=0x398, lpBuffer=0x2e58860, nNumberOfBytesToRead=0xc731, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2e58860*, lpNumberOfBytesRead=0x10af26c*=0xc731, lpOverlapped=0x0) returned 1 [0048.146] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\02cYYkEK8IzC.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\02cYYkEK8IzC.swf.ForgiveME", lpFilePart=0x0) returned 0x62 [0048.146] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\02cYYkEK8IzC.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\02cyykek8izc.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.146] GetFileType (hFile=0x398) returned 0x1 [0048.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0048.146] GetFileType (hFile=0x398) returned 0x1 [0048.146] WriteFile (in: hFile=0x398, lpBuffer=0x2ecae74*, nNumberOfBytesToWrite=0xc740, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2ecae74*, lpNumberOfBytesWritten=0x10af25c*=0xc740, lpOverlapped=0x0) returned 1 [0048.148] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\02cYYkEK8IzC.swf", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\02cYYkEK8IzC.swf", lpFilePart=0x0) returned 0x58 [0048.148] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\02cYYkEK8IzC.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\02cyykek8izc.swf")) returned 1 [0048.149] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\1_Mbsa5OD.avi", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\1_Mbsa5OD.avi", lpFilePart=0x0) returned 0x55 [0048.149] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\1_Mbsa5OD.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\1_mbsa5od.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.149] GetFileType (hFile=0x398) returned 0x1 [0048.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0048.149] GetFileType (hFile=0x398) returned 0x1 [0048.149] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x18ff0 [0048.149] ReadFile (in: hFile=0x398, lpBuffer=0x3fd9378, nNumberOfBytesToRead=0x18ff0, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x3fd9378*, lpNumberOfBytesRead=0x10af26c*=0x18ff0, lpOverlapped=0x0) returned 1 [0048.165] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\1_Mbsa5OD.avi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\1_Mbsa5OD.avi.ForgiveME", lpFilePart=0x0) returned 0x5f [0048.165] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\1_Mbsa5OD.avi.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\1_mbsa5od.avi.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.165] GetFileType (hFile=0x398) returned 0x1 [0048.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0048.166] GetFileType (hFile=0x398) returned 0x1 [0048.166] WriteFile (in: hFile=0x398, lpBuffer=0x40563a8*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x40563a8*, lpNumberOfBytesWritten=0x10af25c*=0x19000, lpOverlapped=0x0) returned 1 [0048.170] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\1_Mbsa5OD.avi", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\1_Mbsa5OD.avi", lpFilePart=0x0) returned 0x55 [0048.170] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\1_Mbsa5OD.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\1_mbsa5od.avi")) returned 1 [0048.179] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\GsWbzkiCj91tplEo.flv", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\GsWbzkiCj91tplEo.flv", lpFilePart=0x0) returned 0x5c [0048.179] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\GsWbzkiCj91tplEo.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\gswbzkicj91tpleo.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.179] GetFileType (hFile=0x398) returned 0x1 [0048.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0048.179] GetFileType (hFile=0x398) returned 0x1 [0048.179] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0xf63e [0048.180] ReadFile (in: hFile=0x398, lpBuffer=0x2f24c48, nNumberOfBytesToRead=0xf63e, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2f24c48*, lpNumberOfBytesRead=0x10af26c*=0xf63e, lpOverlapped=0x0) returned 1 [0048.196] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\GsWbzkiCj91tplEo.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\GsWbzkiCj91tplEo.flv.ForgiveME", lpFilePart=0x0) returned 0x66 [0048.196] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\GsWbzkiCj91tplEo.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\gswbzkicj91tpleo.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.196] GetFileType (hFile=0x398) returned 0x1 [0048.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0048.196] GetFileType (hFile=0x398) returned 0x1 [0048.196] WriteFile (in: hFile=0x398, lpBuffer=0x2f9fe08*, nNumberOfBytesToWrite=0xf640, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2f9fe08*, lpNumberOfBytesWritten=0x10af25c*=0xf640, lpOverlapped=0x0) returned 1 [0048.221] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\GsWbzkiCj91tplEo.flv", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\GsWbzkiCj91tplEo.flv", lpFilePart=0x0) returned 0x5c [0048.221] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\GsWbzkiCj91tplEo.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\gswbzkicj91tpleo.flv")) returned 1 [0048.223] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\LyFh.swf", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\LyFh.swf", lpFilePart=0x0) returned 0x50 [0048.223] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\LyFh.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\lyfh.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.223] GetFileType (hFile=0x398) returned 0x1 [0048.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0048.223] GetFileType (hFile=0x398) returned 0x1 [0048.223] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x1332 [0048.223] ReadFile (in: hFile=0x398, lpBuffer=0x2faf820, nNumberOfBytesToRead=0x1332, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2faf820*, lpNumberOfBytesRead=0x10af26c*=0x1332, lpOverlapped=0x0) returned 1 [0048.237] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\LyFh.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\LyFh.swf.ForgiveME", lpFilePart=0x0) returned 0x5a [0048.237] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\LyFh.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\lyfh.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.238] GetFileType (hFile=0x398) returned 0x1 [0048.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0048.238] GetFileType (hFile=0x398) returned 0x1 [0048.238] WriteFile (in: hFile=0x398, lpBuffer=0x3002734*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x3002734*, lpNumberOfBytesWritten=0x10af25c*=0x1340, lpOverlapped=0x0) returned 1 [0048.239] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\LyFh.swf", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\LyFh.swf", lpFilePart=0x0) returned 0x50 [0048.239] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\LyFh.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\lyfh.swf")) returned 1 [0048.240] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\nocuTy_hMJBgr8.swf", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\nocuTy_hMJBgr8.swf", lpFilePart=0x0) returned 0x5a [0048.240] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\nocuTy_hMJBgr8.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\nocuty_hmjbgr8.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.240] GetFileType (hFile=0x398) returned 0x1 [0048.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0048.240] GetFileType (hFile=0x398) returned 0x1 [0048.240] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x50e9 [0048.240] ReadFile (in: hFile=0x398, lpBuffer=0x3003e2c, nNumberOfBytesToRead=0x50e9, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x3003e2c*, lpNumberOfBytesRead=0x10af26c*=0x50e9, lpOverlapped=0x0) returned 1 [0048.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\nocuTy_hMJBgr8.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\nocuTy_hMJBgr8.swf.ForgiveME", lpFilePart=0x0) returned 0x64 [0048.263] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\nocuTy_hMJBgr8.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\nocuty_hmjbgr8.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.263] GetFileType (hFile=0x398) returned 0x1 [0048.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0048.263] GetFileType (hFile=0x398) returned 0x1 [0048.263] WriteFile (in: hFile=0x398, lpBuffer=0x2e5f29c*, nNumberOfBytesToWrite=0x50f0, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2e5f29c*, lpNumberOfBytesWritten=0x10af25c*=0x50f0, lpOverlapped=0x0) returned 1 [0048.264] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\nocuTy_hMJBgr8.swf", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\nocuTy_hMJBgr8.swf", lpFilePart=0x0) returned 0x5a [0048.264] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\nocuTy_hMJBgr8.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\nocuty_hmjbgr8.swf")) returned 1 [0048.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\TwziikiGxp.mp4", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\TwziikiGxp.mp4", lpFilePart=0x0) returned 0x56 [0048.265] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\TwziikiGxp.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\twziikigxp.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.265] GetFileType (hFile=0x398) returned 0x1 [0048.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0048.265] GetFileType (hFile=0x398) returned 0x1 [0048.265] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x9906 [0048.265] ReadFile (in: hFile=0x398, lpBuffer=0x2e64770, nNumberOfBytesToRead=0x9906, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2e64770*, lpNumberOfBytesRead=0x10af26c*=0x9906, lpOverlapped=0x0) returned 1 [0048.281] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\TwziikiGxp.mp4.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\TwziikiGxp.mp4.ForgiveME", lpFilePart=0x0) returned 0x60 [0048.281] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\TwziikiGxp.mp4.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\twziikigxp.mp4.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.282] GetFileType (hFile=0x398) returned 0x1 [0048.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0048.282] GetFileType (hFile=0x398) returned 0x1 [0048.282] WriteFile (in: hFile=0x398, lpBuffer=0x2ee14fc*, nNumberOfBytesToWrite=0x9910, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2ee14fc*, lpNumberOfBytesWritten=0x10af25c*=0x9910, lpOverlapped=0x0) returned 1 [0048.283] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\TwziikiGxp.mp4", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\TwziikiGxp.mp4", lpFilePart=0x0) returned 0x56 [0048.283] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\TwziikiGxp.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\twziikigxp.mp4")) returned 1 [0048.286] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\ZcHrAt.mp4", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\ZcHrAt.mp4", lpFilePart=0x0) returned 0x52 [0048.286] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\ZcHrAt.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\zchrat.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.286] GetFileType (hFile=0x398) returned 0x1 [0048.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0048.286] GetFileType (hFile=0x398) returned 0x1 [0048.286] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0xfa40 [0048.286] ReadFile (in: hFile=0x398, lpBuffer=0x2eeb1c8, nNumberOfBytesToRead=0xfa40, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2eeb1c8*, lpNumberOfBytesRead=0x10af26c*=0xfa40, lpOverlapped=0x0) returned 1 [0048.312] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\ZcHrAt.mp4.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\ZcHrAt.mp4.ForgiveME", lpFilePart=0x0) returned 0x5c [0048.312] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\ZcHrAt.mp4.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\zchrat.mp4.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.312] GetFileType (hFile=0x398) returned 0x1 [0048.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0048.313] GetFileType (hFile=0x398) returned 0x1 [0048.313] WriteFile (in: hFile=0x398, lpBuffer=0x2f66fa0*, nNumberOfBytesToWrite=0xfa50, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2f66fa0*, lpNumberOfBytesWritten=0x10af25c*=0xfa50, lpOverlapped=0x0) returned 1 [0048.314] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\ZcHrAt.mp4", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\ZcHrAt.mp4", lpFilePart=0x0) returned 0x52 [0048.314] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\W_2oE9qXQ-AL\\fNkfIsQ9nuirE9UHiz\\oWG6Vi 6Ok\\ZcHrAt.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w_2oe9qxq-al\\fnkfisq9nuire9uhiz\\owg6vi 6ok\\zchrat.mp4")) returned 1 [0048.316] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x10aee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0048.316] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", nBufferLength=0x105, lpBuffer=0x10aee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpFilePart=0x0) returned 0x20 [0048.316] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*", lpFindFileData=0x10af0b0 | out: lpFindFileData=0x10af0b0) returned 0x145c9c8 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 0 [0048.317] FindClose (in: hFindFile=0x145c9c8 | out: hFindFile=0x145c9c8) returned 1 [0048.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af348) returned 1 [0048.317] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x10aee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0048.317] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", nBufferLength=0x105, lpBuffer=0x10aee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpFilePart=0x0) returned 0x20 [0048.317] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*", lpFindFileData=0x10af0b0 | out: lpFindFileData=0x10af0b0) returned 0x145c808 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.318] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.319] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.319] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.319] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.319] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.319] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.319] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.319] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.319] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.319] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.319] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0048.319] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 0 [0048.319] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0048.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af348) returned 1 [0048.319] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1PVXIHxYSn.pptx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1PVXIHxYSn.pptx", lpFilePart=0x0) returned 0x2f [0048.319] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1PVXIHxYSn.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1pvxihxysn.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.319] GetFileType (hFile=0x398) returned 0x1 [0048.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.319] GetFileType (hFile=0x398) returned 0x1 [0048.319] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xb44a [0048.319] ReadFile (in: hFile=0x398, lpBuffer=0x2f7e400, nNumberOfBytesToRead=0xb44a, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f7e400*, lpNumberOfBytesRead=0x10af320*=0xb44a, lpOverlapped=0x0) returned 1 [0048.335] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1PVXIHxYSn.pptx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1PVXIHxYSn.pptx.ForgiveME", lpFilePart=0x0) returned 0x39 [0048.335] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1PVXIHxYSn.pptx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1pvxihxysn.pptx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.336] GetFileType (hFile=0x398) returned 0x1 [0048.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.336] GetFileType (hFile=0x398) returned 0x1 [0048.336] WriteFile (in: hFile=0x398, lpBuffer=0x2fecf94*, nNumberOfBytesToWrite=0xb450, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fecf94*, lpNumberOfBytesWritten=0x10af310*=0xb450, lpOverlapped=0x0) returned 1 [0048.337] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1PVXIHxYSn.pptx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1PVXIHxYSn.pptx", lpFilePart=0x0) returned 0x2f [0048.337] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1PVXIHxYSn.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1pvxihxysn.pptx")) returned 1 [0048.342] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\2ZJo.odp", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\2ZJo.odp", lpFilePart=0x0) returned 0x28 [0048.342] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\2ZJo.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\2zjo.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.342] GetFileType (hFile=0x398) returned 0x1 [0048.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.342] GetFileType (hFile=0x398) returned 0x1 [0048.342] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x99e2 [0048.342] ReadFile (in: hFile=0x398, lpBuffer=0x2ff86a8, nNumberOfBytesToRead=0x99e2, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ff86a8*, lpNumberOfBytesRead=0x10af320*=0x99e2, lpOverlapped=0x0) returned 1 [0048.359] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\2ZJo.odp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\2ZJo.odp.ForgiveME", lpFilePart=0x0) returned 0x32 [0048.359] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\2ZJo.odp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\2zjo.odp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.360] GetFileType (hFile=0x398) returned 0x1 [0048.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.360] GetFileType (hFile=0x398) returned 0x1 [0048.360] WriteFile (in: hFile=0x398, lpBuffer=0x2e7ab8c*, nNumberOfBytesToWrite=0x99f0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e7ab8c*, lpNumberOfBytesWritten=0x10af310*=0x99f0, lpOverlapped=0x0) returned 1 [0048.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\2ZJo.odp", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\2ZJo.odp", lpFilePart=0x0) returned 0x28 [0048.361] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\2ZJo.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\2zjo.odp")) returned 1 [0048.362] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\6iEtKnvzXA3NILr.odp", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\6iEtKnvzXA3NILr.odp", lpFilePart=0x0) returned 0x33 [0048.362] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\6iEtKnvzXA3NILr.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\6ietknvzxa3nilr.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.362] GetFileType (hFile=0x398) returned 0x1 [0048.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.362] GetFileType (hFile=0x398) returned 0x1 [0048.362] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x10021 [0048.363] ReadFile (in: hFile=0x398, lpBuffer=0x2e84844, nNumberOfBytesToRead=0x10021, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e84844*, lpNumberOfBytesRead=0x10af320*=0x10021, lpOverlapped=0x0) returned 1 [0048.379] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\6iEtKnvzXA3NILr.odp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\6iEtKnvzXA3NILr.odp.ForgiveME", lpFilePart=0x0) returned 0x3d [0048.379] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\6iEtKnvzXA3NILr.odp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\6ietknvzxa3nilr.odp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.380] GetFileType (hFile=0x398) returned 0x1 [0048.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.380] GetFileType (hFile=0x398) returned 0x1 [0048.380] WriteFile (in: hFile=0x398, lpBuffer=0x2f018dc*, nNumberOfBytesToWrite=0x10030, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f018dc*, lpNumberOfBytesWritten=0x10af310*=0x10030, lpOverlapped=0x0) returned 1 [0048.381] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\6iEtKnvzXA3NILr.odp", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\6iEtKnvzXA3NILr.odp", lpFilePart=0x0) returned 0x33 [0048.381] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\6iEtKnvzXA3NILr.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\6ietknvzxa3nilr.odp")) returned 1 [0048.383] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\alf9WvNZZhe.pptx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\alf9WvNZZhe.pptx", lpFilePart=0x0) returned 0x30 [0048.383] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\alf9WvNZZhe.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\alf9wvnzzhe.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.383] GetFileType (hFile=0x398) returned 0x1 [0048.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.383] GetFileType (hFile=0x398) returned 0x1 [0048.383] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x908d [0048.383] ReadFile (in: hFile=0x398, lpBuffer=0x2f11c08, nNumberOfBytesToRead=0x908d, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f11c08*, lpNumberOfBytesRead=0x10af320*=0x908d, lpOverlapped=0x0) returned 1 [0048.397] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\alf9WvNZZhe.pptx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\alf9WvNZZhe.pptx.ForgiveME", lpFilePart=0x0) returned 0x3a [0048.397] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\alf9WvNZZhe.pptx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\alf9wvnzzhe.pptx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.398] GetFileType (hFile=0x398) returned 0x1 [0048.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.398] GetFileType (hFile=0x398) returned 0x1 [0048.398] WriteFile (in: hFile=0x398, lpBuffer=0x2f8bd6c*, nNumberOfBytesToWrite=0x9090, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f8bd6c*, lpNumberOfBytesWritten=0x10af310*=0x9090, lpOverlapped=0x0) returned 1 [0048.399] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\alf9WvNZZhe.pptx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\alf9WvNZZhe.pptx", lpFilePart=0x0) returned 0x30 [0048.399] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\alf9WvNZZhe.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\alf9wvnzzhe.pptx")) returned 1 [0048.400] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\ASTYhT3_-KErSuEO.pptx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\ASTYhT3_-KErSuEO.pptx", lpFilePart=0x0) returned 0x35 [0048.401] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\ASTYhT3_-KErSuEO.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\astyht3_-kersueo.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.401] GetFileType (hFile=0x398) returned 0x1 [0048.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.401] GetFileType (hFile=0x398) returned 0x1 [0048.401] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xe838 [0048.401] ReadFile (in: hFile=0x398, lpBuffer=0x2f950fc, nNumberOfBytesToRead=0xe838, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f950fc*, lpNumberOfBytesRead=0x10af320*=0xe838, lpOverlapped=0x0) returned 1 [0048.416] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\ASTYhT3_-KErSuEO.pptx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\ASTYhT3_-KErSuEO.pptx.ForgiveME", lpFilePart=0x0) returned 0x3f [0048.416] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\ASTYhT3_-KErSuEO.pptx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\astyht3_-kersueo.pptx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.416] GetFileType (hFile=0x398) returned 0x1 [0048.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.416] GetFileType (hFile=0x398) returned 0x1 [0048.416] WriteFile (in: hFile=0x398, lpBuffer=0x300d868*, nNumberOfBytesToWrite=0xe840, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x300d868*, lpNumberOfBytesWritten=0x10af310*=0xe840, lpOverlapped=0x0) returned 1 [0048.418] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\ASTYhT3_-KErSuEO.pptx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\ASTYhT3_-KErSuEO.pptx", lpFilePart=0x0) returned 0x35 [0048.418] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\ASTYhT3_-KErSuEO.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\astyht3_-kersueo.pptx")) returned 1 [0048.419] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AXWzIZ XtfZeI7.pptx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AXWzIZ XtfZeI7.pptx", lpFilePart=0x0) returned 0x33 [0048.419] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AXWzIZ XtfZeI7.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\axwziz xtfzei7.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.419] GetFileType (hFile=0x398) returned 0x1 [0048.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.419] GetFileType (hFile=0x398) returned 0x1 [0048.419] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x18a89 [0048.432] ReadFile (in: hFile=0x398, lpBuffer=0x3df98d0, nNumberOfBytesToRead=0x18a89, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3df98d0*, lpNumberOfBytesRead=0x10af320*=0x18a89, lpOverlapped=0x0) returned 1 [0048.452] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AXWzIZ XtfZeI7.pptx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AXWzIZ XtfZeI7.pptx.ForgiveME", lpFilePart=0x0) returned 0x3d [0048.452] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AXWzIZ XtfZeI7.pptx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\axwziz xtfzei7.pptx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.452] GetFileType (hFile=0x398) returned 0x1 [0048.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.452] GetFileType (hFile=0x398) returned 0x1 [0048.452] WriteFile (in: hFile=0x398, lpBuffer=0x3e74dd8*, nNumberOfBytesToWrite=0x18a90, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3e74dd8*, lpNumberOfBytesWritten=0x10af310*=0x18a90, lpOverlapped=0x0) returned 1 [0048.454] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AXWzIZ XtfZeI7.pptx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AXWzIZ XtfZeI7.pptx", lpFilePart=0x0) returned 0x33 [0048.454] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\AXWzIZ XtfZeI7.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\axwziz xtfzei7.pptx")) returned 1 [0048.455] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x2f [0048.455] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.456] GetFileType (hFile=0x398) returned 0x1 [0048.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.456] GetFileType (hFile=0x398) returned 0x1 [0048.456] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x57000 [0048.456] ReadFile (in: hFile=0x398, lpBuffer=0x3e8d888, nNumberOfBytesToRead=0x57000, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3e8d888*, lpNumberOfBytesRead=0x10af320*=0x57000, lpOverlapped=0x0) returned 1 [0048.526] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb.ForgiveME", lpFilePart=0x0) returned 0x39 [0048.526] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.527] GetFileType (hFile=0x398) returned 0x1 [0048.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.527] GetFileType (hFile=0x398) returned 0x1 [0048.527] WriteFile (in: hFile=0x398, lpBuffer=0x4040908*, nNumberOfBytesToWrite=0x57010, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x4040908*, lpNumberOfBytesWritten=0x10af310*=0x57010, lpOverlapped=0x0) returned 1 [0048.531] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x2f [0048.531] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb")) returned 1 [0048.535] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GBG4znVzrwk7dXMug.docx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GBG4znVzrwk7dXMug.docx", lpFilePart=0x0) returned 0x36 [0048.535] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GBG4znVzrwk7dXMug.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gbg4znvzrwk7dxmug.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.535] GetFileType (hFile=0x398) returned 0x1 [0048.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.535] GetFileType (hFile=0x398) returned 0x1 [0048.535] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x12a2b [0048.535] ReadFile (in: hFile=0x398, lpBuffer=0x2ea15f8, nNumberOfBytesToRead=0x12a2b, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ea15f8*, lpNumberOfBytesRead=0x10af320*=0x12a2b, lpOverlapped=0x0) returned 1 [0048.551] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GBG4znVzrwk7dXMug.docx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GBG4znVzrwk7dXMug.docx.ForgiveME", lpFilePart=0x0) returned 0x40 [0048.551] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GBG4znVzrwk7dXMug.docx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gbg4znvzrwk7dxmug.docx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.552] GetFileType (hFile=0x398) returned 0x1 [0048.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.552] GetFileType (hFile=0x398) returned 0x1 [0048.552] WriteFile (in: hFile=0x398, lpBuffer=0x2f2633c*, nNumberOfBytesToWrite=0x12a30, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f2633c*, lpNumberOfBytesWritten=0x10af310*=0x12a30, lpOverlapped=0x0) returned 1 [0048.553] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GBG4znVzrwk7dXMug.docx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GBG4znVzrwk7dXMug.docx", lpFilePart=0x0) returned 0x36 [0048.553] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GBG4znVzrwk7dXMug.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gbg4znvzrwk7dxmug.docx")) returned 1 [0048.555] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GYGdW1MQkx5vJ.pptx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GYGdW1MQkx5vJ.pptx", lpFilePart=0x0) returned 0x32 [0048.555] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GYGdW1MQkx5vJ.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gygdw1mqkx5vj.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.555] GetFileType (hFile=0x398) returned 0x1 [0048.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.555] GetFileType (hFile=0x398) returned 0x1 [0048.555] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x11710 [0048.555] ReadFile (in: hFile=0x398, lpBuffer=0x2f39088, nNumberOfBytesToRead=0x11710, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f39088*, lpNumberOfBytesRead=0x10af320*=0x11710, lpOverlapped=0x0) returned 1 [0048.571] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GYGdW1MQkx5vJ.pptx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GYGdW1MQkx5vJ.pptx.ForgiveME", lpFilePart=0x0) returned 0x3c [0048.571] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GYGdW1MQkx5vJ.pptx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gygdw1mqkx5vj.pptx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.572] GetFileType (hFile=0x398) returned 0x1 [0048.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.572] GetFileType (hFile=0x398) returned 0x1 [0048.572] WriteFile (in: hFile=0x398, lpBuffer=0x2fba490*, nNumberOfBytesToWrite=0x11720, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fba490*, lpNumberOfBytesWritten=0x10af310*=0x11720, lpOverlapped=0x0) returned 1 [0048.574] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GYGdW1MQkx5vJ.pptx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GYGdW1MQkx5vJ.pptx", lpFilePart=0x0) returned 0x32 [0048.574] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\GYGdW1MQkx5vJ.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gygdw1mqkx5vj.pptx")) returned 1 [0048.575] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\HRQl3qsS4DH.xlsx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\HRQl3qsS4DH.xlsx", lpFilePart=0x0) returned 0x30 [0048.575] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\HRQl3qsS4DH.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\hrql3qss4dh.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.575] GetFileType (hFile=0x398) returned 0x1 [0048.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.575] GetFileType (hFile=0x398) returned 0x1 [0048.575] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x164ef [0048.576] ReadFile (in: hFile=0x398, lpBuffer=0x40dfbd8, nNumberOfBytesToRead=0x164ef, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x40dfbd8*, lpNumberOfBytesRead=0x10af320*=0x164ef, lpOverlapped=0x0) returned 1 [0048.596] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\HRQl3qsS4DH.xlsx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\HRQl3qsS4DH.xlsx.ForgiveME", lpFilePart=0x0) returned 0x3a [0048.596] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\HRQl3qsS4DH.xlsx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\hrql3qss4dh.xlsx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.596] GetFileType (hFile=0x398) returned 0x1 [0048.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.596] GetFileType (hFile=0x398) returned 0x1 [0048.596] WriteFile (in: hFile=0x398, lpBuffer=0x3e3c7b0*, nNumberOfBytesToWrite=0x164f0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3e3c7b0*, lpNumberOfBytesWritten=0x10af310*=0x164f0, lpOverlapped=0x0) returned 1 [0048.598] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\HRQl3qsS4DH.xlsx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\HRQl3qsS4DH.xlsx", lpFilePart=0x0) returned 0x30 [0048.598] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\HRQl3qsS4DH.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\hrql3qss4dh.xlsx")) returned 1 [0048.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\iUFFUwpA1J.xlsx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\iUFFUwpA1J.xlsx", lpFilePart=0x0) returned 0x2f [0048.599] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\iUFFUwpA1J.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\iuffuwpa1j.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.600] GetFileType (hFile=0x398) returned 0x1 [0048.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.600] GetFileType (hFile=0x398) returned 0x1 [0048.600] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x132c5 [0048.600] ReadFile (in: hFile=0x398, lpBuffer=0x2e1977c, nNumberOfBytesToRead=0x132c5, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e1977c*, lpNumberOfBytesRead=0x10af320*=0x132c5, lpOverlapped=0x0) returned 1 [0048.616] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\iUFFUwpA1J.xlsx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\iUFFUwpA1J.xlsx.ForgiveME", lpFilePart=0x0) returned 0x39 [0048.616] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\iUFFUwpA1J.xlsx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\iuffuwpa1j.xlsx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.616] GetFileType (hFile=0x398) returned 0x1 [0048.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.617] GetFileType (hFile=0x398) returned 0x1 [0048.617] WriteFile (in: hFile=0x398, lpBuffer=0x2e9ffec*, nNumberOfBytesToWrite=0x132d0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e9ffec*, lpNumberOfBytesWritten=0x10af310*=0x132d0, lpOverlapped=0x0) returned 1 [0048.618] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\iUFFUwpA1J.xlsx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\iUFFUwpA1J.xlsx", lpFilePart=0x0) returned 0x2f [0048.619] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\iUFFUwpA1J.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\iuffuwpa1j.xlsx")) returned 1 [0048.620] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jBLr-FEHfL8MBj 678p.docx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jBLr-FEHfL8MBj 678p.docx", lpFilePart=0x0) returned 0x38 [0048.620] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jBLr-FEHfL8MBj 678p.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jblr-fehfl8mbj 678p.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.620] GetFileType (hFile=0x398) returned 0x1 [0048.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.620] GetFileType (hFile=0x398) returned 0x1 [0048.620] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x11a00 [0048.620] ReadFile (in: hFile=0x398, lpBuffer=0x2eb35c0, nNumberOfBytesToRead=0x11a00, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2eb35c0*, lpNumberOfBytesRead=0x10af320*=0x11a00, lpOverlapped=0x0) returned 1 [0048.636] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jBLr-FEHfL8MBj 678p.docx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jBLr-FEHfL8MBj 678p.docx.ForgiveME", lpFilePart=0x0) returned 0x42 [0048.636] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jBLr-FEHfL8MBj 678p.docx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jblr-fehfl8mbj 678p.docx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.637] GetFileType (hFile=0x398) returned 0x1 [0048.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.637] GetFileType (hFile=0x398) returned 0x1 [0048.637] WriteFile (in: hFile=0x398, lpBuffer=0x2f352a4*, nNumberOfBytesToWrite=0x11a10, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f352a4*, lpNumberOfBytesWritten=0x10af310*=0x11a10, lpOverlapped=0x0) returned 1 [0048.638] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jBLr-FEHfL8MBj 678p.docx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jBLr-FEHfL8MBj 678p.docx", lpFilePart=0x0) returned 0x38 [0048.638] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jBLr-FEHfL8MBj 678p.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jblr-fehfl8mbj 678p.docx")) returned 1 [0048.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\JFqgi.xlsx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\JFqgi.xlsx", lpFilePart=0x0) returned 0x2a [0048.640] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\JFqgi.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jfqgi.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.640] GetFileType (hFile=0x398) returned 0x1 [0048.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.640] GetFileType (hFile=0x398) returned 0x1 [0048.640] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x8a0e [0048.640] ReadFile (in: hFile=0x398, lpBuffer=0x2f46fbc, nNumberOfBytesToRead=0x8a0e, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f46fbc*, lpNumberOfBytesRead=0x10af320*=0x8a0e, lpOverlapped=0x0) returned 1 [0048.655] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\JFqgi.xlsx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\JFqgi.xlsx.ForgiveME", lpFilePart=0x0) returned 0x34 [0048.655] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\JFqgi.xlsx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jfqgi.xlsx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.655] GetFileType (hFile=0x398) returned 0x1 [0048.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.655] GetFileType (hFile=0x398) returned 0x1 [0048.655] WriteFile (in: hFile=0x398, lpBuffer=0x2fbf094*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fbf094*, lpNumberOfBytesWritten=0x10af310*=0x8a10, lpOverlapped=0x0) returned 1 [0048.656] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\JFqgi.xlsx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\JFqgi.xlsx", lpFilePart=0x0) returned 0x2a [0048.656] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\JFqgi.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jfqgi.xlsx")) returned 1 [0048.657] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jmKrommVXMPs.pptx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jmKrommVXMPs.pptx", lpFilePart=0x0) returned 0x31 [0048.658] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jmKrommVXMPs.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jmkrommvxmps.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.658] GetFileType (hFile=0x398) returned 0x1 [0048.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.658] GetFileType (hFile=0x398) returned 0x1 [0048.658] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x2aca [0048.658] ReadFile (in: hFile=0x398, lpBuffer=0x2fc7d70, nNumberOfBytesToRead=0x2aca, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2fc7d70*, lpNumberOfBytesRead=0x10af320*=0x2aca, lpOverlapped=0x0) returned 1 [0048.674] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jmKrommVXMPs.pptx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jmKrommVXMPs.pptx.ForgiveME", lpFilePart=0x0) returned 0x3b [0048.674] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jmKrommVXMPs.pptx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jmkrommvxmps.pptx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.674] GetFileType (hFile=0x398) returned 0x1 [0048.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.675] GetFileType (hFile=0x398) returned 0x1 [0048.675] WriteFile (in: hFile=0x398, lpBuffer=0x2e214fc*, nNumberOfBytesToWrite=0x2ad0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e214fc*, lpNumberOfBytesWritten=0x10af310*=0x2ad0, lpOverlapped=0x0) returned 1 [0048.676] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jmKrommVXMPs.pptx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jmKrommVXMPs.pptx", lpFilePart=0x0) returned 0x31 [0048.676] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\jmKrommVXMPs.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\jmkrommvxmps.pptx")) returned 1 [0048.677] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OWCI8VPPCALiOrXC.docx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OWCI8VPPCALiOrXC.docx", lpFilePart=0x0) returned 0x35 [0048.677] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OWCI8VPPCALiOrXC.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\owci8vppcaliorxc.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.677] GetFileType (hFile=0x398) returned 0x1 [0048.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.678] GetFileType (hFile=0x398) returned 0x1 [0048.678] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x142f4 [0048.678] ReadFile (in: hFile=0x398, lpBuffer=0x2e242cc, nNumberOfBytesToRead=0x142f4, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e242cc*, lpNumberOfBytesRead=0x10af320*=0x142f4, lpOverlapped=0x0) returned 1 [0048.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OWCI8VPPCALiOrXC.docx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OWCI8VPPCALiOrXC.docx.ForgiveME", lpFilePart=0x0) returned 0x3f [0048.693] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OWCI8VPPCALiOrXC.docx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\owci8vppcaliorxc.docx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.694] GetFileType (hFile=0x398) returned 0x1 [0048.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.694] GetFileType (hFile=0x398) returned 0x1 [0048.694] WriteFile (in: hFile=0x398, lpBuffer=0x2eadbd4*, nNumberOfBytesToWrite=0x14300, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2eadbd4*, lpNumberOfBytesWritten=0x10af310*=0x14300, lpOverlapped=0x0) returned 1 [0048.699] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OWCI8VPPCALiOrXC.docx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OWCI8VPPCALiOrXC.docx", lpFilePart=0x0) returned 0x35 [0048.699] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OWCI8VPPCALiOrXC.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\owci8vppcaliorxc.docx")) returned 1 [0048.701] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\P0D0-WsgkffXuDW.rtf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\P0D0-WsgkffXuDW.rtf", lpFilePart=0x0) returned 0x33 [0048.701] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\P0D0-WsgkffXuDW.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\p0d0-wsgkffxudw.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.701] GetFileType (hFile=0x398) returned 0x1 [0048.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.701] GetFileType (hFile=0x398) returned 0x1 [0048.701] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x1622 [0048.701] ReadFile (in: hFile=0x398, lpBuffer=0x2ec21e4, nNumberOfBytesToRead=0x1622, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ec21e4*, lpNumberOfBytesRead=0x10af320*=0x1622, lpOverlapped=0x0) returned 1 [0048.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\P0D0-WsgkffXuDW.rtf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\P0D0-WsgkffXuDW.rtf.ForgiveME", lpFilePart=0x0) returned 0x3d [0048.716] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\P0D0-WsgkffXuDW.rtf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\p0d0-wsgkffxudw.rtf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.716] GetFileType (hFile=0x398) returned 0x1 [0048.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.716] GetFileType (hFile=0x398) returned 0x1 [0048.716] WriteFile (in: hFile=0x398, lpBuffer=0x2f15f6c*, nNumberOfBytesToWrite=0x1630, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f15f6c*, lpNumberOfBytesWritten=0x10af310*=0x1630, lpOverlapped=0x0) returned 1 [0048.721] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\P0D0-WsgkffXuDW.rtf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\P0D0-WsgkffXuDW.rtf", lpFilePart=0x0) returned 0x33 [0048.721] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\P0D0-WsgkffXuDW.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\p0d0-wsgkffxudw.rtf")) returned 1 [0048.722] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qErym4KglNw.docx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qErym4KglNw.docx", lpFilePart=0x0) returned 0x30 [0048.722] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qErym4KglNw.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\qerym4kglnw.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.722] GetFileType (hFile=0x398) returned 0x1 [0048.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.722] GetFileType (hFile=0x398) returned 0x1 [0048.722] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xe2b4 [0048.722] ReadFile (in: hFile=0x398, lpBuffer=0x2f17898, nNumberOfBytesToRead=0xe2b4, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f17898*, lpNumberOfBytesRead=0x10af320*=0xe2b4, lpOverlapped=0x0) returned 1 [0048.738] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qErym4KglNw.docx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qErym4KglNw.docx.ForgiveME", lpFilePart=0x0) returned 0x3a [0048.738] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qErym4KglNw.docx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\qerym4kglnw.docx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.739] GetFileType (hFile=0x398) returned 0x1 [0048.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.739] GetFileType (hFile=0x398) returned 0x1 [0048.739] WriteFile (in: hFile=0x398, lpBuffer=0x2f8ef7c*, nNumberOfBytesToWrite=0xe2c0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f8ef7c*, lpNumberOfBytesWritten=0x10af310*=0xe2c0, lpOverlapped=0x0) returned 1 [0048.740] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qErym4KglNw.docx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qErym4KglNw.docx", lpFilePart=0x0) returned 0x30 [0048.740] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qErym4KglNw.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\qerym4kglnw.docx")) returned 1 [0048.741] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RGMA2.docx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RGMA2.docx", lpFilePart=0x0) returned 0x2a [0048.741] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RGMA2.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rgma2.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.742] GetFileType (hFile=0x398) returned 0x1 [0048.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.742] GetFileType (hFile=0x398) returned 0x1 [0048.742] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x12850 [0048.742] ReadFile (in: hFile=0x398, lpBuffer=0x2f9d514, nNumberOfBytesToRead=0x12850, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f9d514*, lpNumberOfBytesRead=0x10af320*=0x12850, lpOverlapped=0x0) returned 1 [0048.759] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RGMA2.docx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RGMA2.docx.ForgiveME", lpFilePart=0x0) returned 0x34 [0048.759] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RGMA2.docx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rgma2.docx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.760] GetFileType (hFile=0x398) returned 0x1 [0048.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.760] GetFileType (hFile=0x398) returned 0x1 [0048.760] WriteFile (in: hFile=0x398, lpBuffer=0x2e2bd08*, nNumberOfBytesToWrite=0x12860, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e2bd08*, lpNumberOfBytesWritten=0x10af310*=0x12860, lpOverlapped=0x0) returned 1 [0048.761] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RGMA2.docx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RGMA2.docx", lpFilePart=0x0) returned 0x2a [0048.761] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RGMA2.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rgma2.docx")) returned 1 [0048.763] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RS-xsaOLj5rgX61.pdf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RS-xsaOLj5rgX61.pdf", lpFilePart=0x0) returned 0x33 [0048.763] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RS-xsaOLj5rgX61.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rs-xsaolj5rgx61.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.763] GetFileType (hFile=0x398) returned 0x1 [0048.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.763] GetFileType (hFile=0x398) returned 0x1 [0048.763] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x4aa7 [0048.763] ReadFile (in: hFile=0x398, lpBuffer=0x2e3e83c, nNumberOfBytesToRead=0x4aa7, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e3e83c*, lpNumberOfBytesRead=0x10af320*=0x4aa7, lpOverlapped=0x0) returned 1 [0048.777] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RS-xsaOLj5rgX61.pdf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RS-xsaOLj5rgX61.pdf.ForgiveME", lpFilePart=0x0) returned 0x3d [0048.777] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RS-xsaOLj5rgX61.pdf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rs-xsaolj5rgx61.pdf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.778] GetFileType (hFile=0x398) returned 0x1 [0048.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.778] GetFileType (hFile=0x398) returned 0x1 [0048.778] WriteFile (in: hFile=0x398, lpBuffer=0x2ea2da0*, nNumberOfBytesToWrite=0x4ab0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2ea2da0*, lpNumberOfBytesWritten=0x10af310*=0x4ab0, lpOverlapped=0x0) returned 1 [0048.779] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RS-xsaOLj5rgX61.pdf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RS-xsaOLj5rgX61.pdf", lpFilePart=0x0) returned 0x33 [0048.779] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RS-xsaOLj5rgX61.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rs-xsaolj5rgx61.pdf")) returned 1 [0048.780] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\sLaf8w7OVg.doc", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\sLaf8w7OVg.doc", lpFilePart=0x0) returned 0x2e [0048.780] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\sLaf8w7OVg.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\slaf8w7ovg.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.780] GetFileType (hFile=0x398) returned 0x1 [0048.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.780] GetFileType (hFile=0x398) returned 0x1 [0048.780] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x7ddb [0048.780] ReadFile (in: hFile=0x398, lpBuffer=0x2ea7b44, nNumberOfBytesToRead=0x7ddb, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ea7b44*, lpNumberOfBytesRead=0x10af320*=0x7ddb, lpOverlapped=0x0) returned 1 [0048.795] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\sLaf8w7OVg.doc.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\sLaf8w7OVg.doc.ForgiveME", lpFilePart=0x0) returned 0x38 [0048.795] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\sLaf8w7OVg.doc.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\slaf8w7ovg.doc.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.795] GetFileType (hFile=0x398) returned 0x1 [0048.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.795] GetFileType (hFile=0x398) returned 0x1 [0048.795] WriteFile (in: hFile=0x398, lpBuffer=0x2f1bf34*, nNumberOfBytesToWrite=0x7de0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f1bf34*, lpNumberOfBytesWritten=0x10af310*=0x7de0, lpOverlapped=0x0) returned 1 [0048.796] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\sLaf8w7OVg.doc", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\sLaf8w7OVg.doc", lpFilePart=0x0) returned 0x2e [0048.796] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\sLaf8w7OVg.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\slaf8w7ovg.doc")) returned 1 [0048.798] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\TelL5MpYPjO.rtf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\TelL5MpYPjO.rtf", lpFilePart=0x0) returned 0x2f [0048.798] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\TelL5MpYPjO.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tell5mpypjo.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.798] GetFileType (hFile=0x398) returned 0x1 [0048.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.798] GetFileType (hFile=0x398) returned 0x1 [0048.798] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x20bb [0048.798] ReadFile (in: hFile=0x398, lpBuffer=0x2f24044, nNumberOfBytesToRead=0x20bb, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f24044*, lpNumberOfBytesRead=0x10af320*=0x20bb, lpOverlapped=0x0) returned 1 [0048.812] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\TelL5MpYPjO.rtf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\TelL5MpYPjO.rtf.ForgiveME", lpFilePart=0x0) returned 0x39 [0048.812] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\TelL5MpYPjO.rtf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tell5mpypjo.rtf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.812] GetFileType (hFile=0x398) returned 0x1 [0048.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.812] GetFileType (hFile=0x398) returned 0x1 [0048.812] WriteFile (in: hFile=0x398, lpBuffer=0x2f7b294*, nNumberOfBytesToWrite=0x20c0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f7b294*, lpNumberOfBytesWritten=0x10af310*=0x20c0, lpOverlapped=0x0) returned 1 [0048.813] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\TelL5MpYPjO.rtf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\TelL5MpYPjO.rtf", lpFilePart=0x0) returned 0x2f [0048.813] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\TelL5MpYPjO.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tell5mpypjo.rtf")) returned 1 [0048.814] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tLAmXjU3.odt", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tLAmXjU3.odt", lpFilePart=0x0) returned 0x2c [0048.814] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tLAmXjU3.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tlamxju3.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.815] GetFileType (hFile=0x398) returned 0x1 [0048.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.815] GetFileType (hFile=0x398) returned 0x1 [0048.815] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x18c48 [0048.815] ReadFile (in: hFile=0x398, lpBuffer=0x3f062c0, nNumberOfBytesToRead=0x18c48, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3f062c0*, lpNumberOfBytesRead=0x10af320*=0x18c48, lpOverlapped=0x0) returned 1 [0048.830] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tLAmXjU3.odt.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tLAmXjU3.odt.ForgiveME", lpFilePart=0x0) returned 0x36 [0048.830] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tLAmXjU3.odt.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tlamxju3.odt.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.831] GetFileType (hFile=0x398) returned 0x1 [0048.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.831] GetFileType (hFile=0x398) returned 0x1 [0048.831] WriteFile (in: hFile=0x398, lpBuffer=0x3f82088*, nNumberOfBytesToWrite=0x18c50, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3f82088*, lpNumberOfBytesWritten=0x10af310*=0x18c50, lpOverlapped=0x0) returned 1 [0048.833] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tLAmXjU3.odt", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tLAmXjU3.odt", lpFilePart=0x0) returned 0x2c [0048.833] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tLAmXjU3.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tlamxju3.odt")) returned 1 [0048.834] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wENJH2J2udWqojBqky.odt", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wENJH2J2udWqojBqky.odt", lpFilePart=0x0) returned 0x36 [0048.834] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wENJH2J2udWqojBqky.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wenjh2j2udwqojbqky.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.834] GetFileType (hFile=0x398) returned 0x1 [0048.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.834] GetFileType (hFile=0x398) returned 0x1 [0048.834] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xbb16 [0048.834] ReadFile (in: hFile=0x398, lpBuffer=0x2fca7ac, nNumberOfBytesToRead=0xbb16, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2fca7ac*, lpNumberOfBytesRead=0x10af320*=0xbb16, lpOverlapped=0x0) returned 1 [0048.851] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wENJH2J2udWqojBqky.odt.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wENJH2J2udWqojBqky.odt.ForgiveME", lpFilePart=0x0) returned 0x40 [0048.852] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wENJH2J2udWqojBqky.odt.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wenjh2j2udwqojbqky.odt.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.852] GetFileType (hFile=0x398) returned 0x1 [0048.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.852] GetFileType (hFile=0x398) returned 0x1 [0048.852] WriteFile (in: hFile=0x398, lpBuffer=0x2e4f260*, nNumberOfBytesToWrite=0xbb20, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e4f260*, lpNumberOfBytesWritten=0x10af310*=0xbb20, lpOverlapped=0x0) returned 1 [0048.853] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wENJH2J2udWqojBqky.odt", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wENJH2J2udWqojBqky.odt", lpFilePart=0x0) returned 0x36 [0048.853] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wENJH2J2udWqojBqky.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wenjh2j2udwqojbqky.odt")) returned 1 [0048.855] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WhR2YGHKw6JqJ4o1.xlsx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WhR2YGHKw6JqJ4o1.xlsx", lpFilePart=0x0) returned 0x35 [0048.855] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WhR2YGHKw6JqJ4o1.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\whr2yghkw6jqj4o1.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.855] GetFileType (hFile=0x398) returned 0x1 [0048.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.855] GetFileType (hFile=0x398) returned 0x1 [0048.855] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x1039d [0048.855] ReadFile (in: hFile=0x398, lpBuffer=0x2e5b0a4, nNumberOfBytesToRead=0x1039d, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e5b0a4*, lpNumberOfBytesRead=0x10af320*=0x1039d, lpOverlapped=0x0) returned 1 [0048.871] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WhR2YGHKw6JqJ4o1.xlsx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WhR2YGHKw6JqJ4o1.xlsx.ForgiveME", lpFilePart=0x0) returned 0x3f [0048.871] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WhR2YGHKw6JqJ4o1.xlsx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\whr2yghkw6jqj4o1.xlsx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.871] GetFileType (hFile=0x398) returned 0x1 [0048.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.871] GetFileType (hFile=0x398) returned 0x1 [0048.871] WriteFile (in: hFile=0x398, lpBuffer=0x2ed8b90*, nNumberOfBytesToWrite=0x103a0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2ed8b90*, lpNumberOfBytesWritten=0x10af310*=0x103a0, lpOverlapped=0x0) returned 1 [0048.873] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WhR2YGHKw6JqJ4o1.xlsx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WhR2YGHKw6JqJ4o1.xlsx", lpFilePart=0x0) returned 0x35 [0048.873] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WhR2YGHKw6JqJ4o1.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\whr2yghkw6jqj4o1.xlsx")) returned 1 [0048.874] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wsXh9kZhV.xlsx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wsXh9kZhV.xlsx", lpFilePart=0x0) returned 0x2e [0048.874] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wsXh9kZhV.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wsxh9kzhv.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.875] GetFileType (hFile=0x398) returned 0x1 [0048.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.875] GetFileType (hFile=0x398) returned 0x1 [0048.875] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x1fd2 [0048.875] ReadFile (in: hFile=0x398, lpBuffer=0x2ee9230, nNumberOfBytesToRead=0x1fd2, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ee9230*, lpNumberOfBytesRead=0x10af320*=0x1fd2, lpOverlapped=0x0) returned 1 [0048.889] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wsXh9kZhV.xlsx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wsXh9kZhV.xlsx.ForgiveME", lpFilePart=0x0) returned 0x38 [0048.889] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wsXh9kZhV.xlsx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wsxh9kzhv.xlsx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.889] GetFileType (hFile=0x398) returned 0x1 [0048.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.889] GetFileType (hFile=0x398) returned 0x1 [0048.889] WriteFile (in: hFile=0x398, lpBuffer=0x2f40020*, nNumberOfBytesToWrite=0x1fe0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f40020*, lpNumberOfBytesWritten=0x10af310*=0x1fe0, lpOverlapped=0x0) returned 1 [0048.890] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wsXh9kZhV.xlsx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wsXh9kZhV.xlsx", lpFilePart=0x0) returned 0x2e [0048.890] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\wsXh9kZhV.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wsxh9kzhv.xlsx")) returned 1 [0048.891] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Yb_bG3OgzzBcVHOss.pps", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Yb_bG3OgzzBcVHOss.pps", lpFilePart=0x0) returned 0x35 [0048.891] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Yb_bG3OgzzBcVHOss.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yb_bg3ogzzbcvhoss.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.891] GetFileType (hFile=0x398) returned 0x1 [0048.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.892] GetFileType (hFile=0x398) returned 0x1 [0048.892] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xd66a [0048.892] ReadFile (in: hFile=0x398, lpBuffer=0x2f42348, nNumberOfBytesToRead=0xd66a, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f42348*, lpNumberOfBytesRead=0x10af320*=0xd66a, lpOverlapped=0x0) returned 1 [0048.907] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Yb_bG3OgzzBcVHOss.pps.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Yb_bG3OgzzBcVHOss.pps.ForgiveME", lpFilePart=0x0) returned 0x3f [0048.907] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Yb_bG3OgzzBcVHOss.pps.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yb_bg3ogzzbcvhoss.pps.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.907] GetFileType (hFile=0x398) returned 0x1 [0048.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.907] GetFileType (hFile=0x398) returned 0x1 [0048.907] WriteFile (in: hFile=0x398, lpBuffer=0x2fb7548*, nNumberOfBytesToWrite=0xd670, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fb7548*, lpNumberOfBytesWritten=0x10af310*=0xd670, lpOverlapped=0x0) returned 1 [0048.908] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Yb_bG3OgzzBcVHOss.pps", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Yb_bG3OgzzBcVHOss.pps", lpFilePart=0x0) returned 0x35 [0048.908] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Yb_bG3OgzzBcVHOss.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\yb_bg3ogzzbcvhoss.pps")) returned 1 [0048.910] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Zae0.doc", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Zae0.doc", lpFilePart=0x0) returned 0x28 [0048.910] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Zae0.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zae0.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.910] GetFileType (hFile=0x398) returned 0x1 [0048.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.910] GetFileType (hFile=0x398) returned 0x1 [0048.910] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x1628a [0048.911] ReadFile (in: hFile=0x398, lpBuffer=0x3fed758, nNumberOfBytesToRead=0x1628a, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3fed758*, lpNumberOfBytesRead=0x10af320*=0x1628a, lpOverlapped=0x0) returned 1 [0048.928] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Zae0.doc.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Zae0.doc.ForgiveME", lpFilePart=0x0) returned 0x32 [0048.928] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Zae0.doc.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zae0.doc.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.928] GetFileType (hFile=0x398) returned 0x1 [0048.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.928] GetFileType (hFile=0x398) returned 0x1 [0048.928] WriteFile (in: hFile=0x398, lpBuffer=0x405c460*, nNumberOfBytesToWrite=0x16290, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x405c460*, lpNumberOfBytesWritten=0x10af310*=0x16290, lpOverlapped=0x0) returned 1 [0048.930] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Zae0.doc", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Zae0.doc", lpFilePart=0x0) returned 0x28 [0048.930] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Zae0.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zae0.doc")) returned 1 [0048.931] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\zEWzYJBfZKH68.xlsx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\zEWzYJBfZKH68.xlsx", lpFilePart=0x0) returned 0x32 [0048.931] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\zEWzYJBfZKH68.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zewzyjbfzkh68.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.932] GetFileType (hFile=0x398) returned 0x1 [0048.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0048.932] GetFileType (hFile=0x398) returned 0x1 [0048.932] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x13728 [0048.932] ReadFile (in: hFile=0x398, lpBuffer=0x3011ff4, nNumberOfBytesToRead=0x13728, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3011ff4*, lpNumberOfBytesRead=0x10af320*=0x13728, lpOverlapped=0x0) returned 1 [0048.949] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\zEWzYJBfZKH68.xlsx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\zEWzYJBfZKH68.xlsx.ForgiveME", lpFilePart=0x0) returned 0x3c [0048.949] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\zEWzYJBfZKH68.xlsx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zewzyjbfzkh68.xlsx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.949] GetFileType (hFile=0x398) returned 0x1 [0048.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0048.949] GetFileType (hFile=0x398) returned 0x1 [0048.949] WriteFile (in: hFile=0x398, lpBuffer=0x2ead294*, nNumberOfBytesToWrite=0x13730, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2ead294*, lpNumberOfBytesWritten=0x10af310*=0x13730, lpOverlapped=0x0) returned 1 [0048.956] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\zEWzYJBfZKH68.xlsx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\zEWzYJBfZKH68.xlsx", lpFilePart=0x0) returned 0x32 [0048.956] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\zEWzYJBfZKH68.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\zewzyjbfzkh68.xlsx")) returned 1 [0048.957] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya", lpFilePart=0x0) returned 0x25 [0048.957] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\", lpFilePart=0x0) returned 0x26 [0048.957] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c708 [0048.958] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0048.958] FindClose (in: hFindFile=0x145c708 | out: hFindFile=0x145c708) returned 1 [0048.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0048.958] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya", lpFilePart=0x0) returned 0x25 [0048.958] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\", lpFilePart=0x0) returned 0x26 [0048.958] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c848 [0048.958] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.958] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.959] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0048.959] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0048.959] FindClose (in: hFindFile=0x145c848 | out: hFindFile=0x145c848) returned 1 [0048.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0048.959] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\Fo8-.xls", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\Fo8-.xls", lpFilePart=0x0) returned 0x2e [0048.959] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\Fo8-.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\fo8-.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.959] GetFileType (hFile=0x398) returned 0x1 [0048.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0048.959] GetFileType (hFile=0x398) returned 0x1 [0048.959] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x18fff [0048.959] ReadFile (in: hFile=0x398, lpBuffer=0x4099570, nNumberOfBytesToRead=0x18fff, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x4099570*, lpNumberOfBytesRead=0x10af2e4*=0x18fff, lpOverlapped=0x0) returned 1 [0048.979] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\Fo8-.xls.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\Fo8-.xls.ForgiveME", lpFilePart=0x0) returned 0x38 [0048.979] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\Fo8-.xls.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\fo8-.xls.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.980] GetFileType (hFile=0x398) returned 0x1 [0048.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0048.980] GetFileType (hFile=0x398) returned 0x1 [0048.980] WriteFile (in: hFile=0x398, lpBuffer=0x3df98d0*, nNumberOfBytesToWrite=0x19000, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x3df98d0*, lpNumberOfBytesWritten=0x10af2d4*=0x19000, lpOverlapped=0x0) returned 1 [0048.981] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\Fo8-.xls", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\Fo8-.xls", lpFilePart=0x0) returned 0x2e [0048.981] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\Fo8-.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\fo8-.xls")) returned 1 [0048.983] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\frNMq.docx", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\frNMq.docx", lpFilePart=0x0) returned 0x30 [0048.983] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\frNMq.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\frnmq.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.983] GetFileType (hFile=0x398) returned 0x1 [0048.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0048.983] GetFileType (hFile=0x398) returned 0x1 [0048.983] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0xbe0 [0048.983] ReadFile (in: hFile=0x398, lpBuffer=0x2e074b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2e074b0*, lpNumberOfBytesRead=0x10af2e4*=0xbe0, lpOverlapped=0x0) returned 1 [0048.998] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\frNMq.docx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\frNMq.docx.ForgiveME", lpFilePart=0x0) returned 0x3a [0048.998] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\frNMq.docx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\frnmq.docx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0048.999] GetFileType (hFile=0x398) returned 0x1 [0048.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0048.999] GetFileType (hFile=0x398) returned 0x1 [0048.999] WriteFile (in: hFile=0x398, lpBuffer=0x2e59180*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2e59180*, lpNumberOfBytesWritten=0x10af2a8*=0xbf0, lpOverlapped=0x0) returned 1 [0049.000] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\frNMq.docx", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\frNMq.docx", lpFilePart=0x0) returned 0x30 [0049.000] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\frNMq.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\frnmq.docx")) returned 1 [0049.001] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\RkDQuv59W tYRw4EPy.xlsx", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\RkDQuv59W tYRw4EPy.xlsx", lpFilePart=0x0) returned 0x3d [0049.001] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\RkDQuv59W tYRw4EPy.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\rkdquv59w tyrw4epy.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.001] GetFileType (hFile=0x398) returned 0x1 [0049.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0049.001] GetFileType (hFile=0x398) returned 0x1 [0049.001] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x12e5d [0049.001] ReadFile (in: hFile=0x398, lpBuffer=0x2e5a370, nNumberOfBytesToRead=0x12e5d, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2e5a370*, lpNumberOfBytesRead=0x10af2e4*=0x12e5d, lpOverlapped=0x0) returned 1 [0049.017] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\RkDQuv59W tYRw4EPy.xlsx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\RkDQuv59W tYRw4EPy.xlsx.ForgiveME", lpFilePart=0x0) returned 0x47 [0049.017] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\RkDQuv59W tYRw4EPy.xlsx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\rkdquv59w tyrw4epy.xlsx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.017] GetFileType (hFile=0x398) returned 0x1 [0049.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0049.017] GetFileType (hFile=0x398) returned 0x1 [0049.017] WriteFile (in: hFile=0x398, lpBuffer=0x2edfd50*, nNumberOfBytesToWrite=0x12e60, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2edfd50*, lpNumberOfBytesWritten=0x10af2d4*=0x12e60, lpOverlapped=0x0) returned 1 [0049.018] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\RkDQuv59W tYRw4EPy.xlsx", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\RkDQuv59W tYRw4EPy.xlsx", lpFilePart=0x0) returned 0x3d [0049.018] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\RkDQuv59W tYRw4EPy.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\rkdquv59w tyrw4epy.xlsx")) returned 1 [0049.020] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\X9FPcVHoENtd.docx", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\X9FPcVHoENtd.docx", lpFilePart=0x0) returned 0x37 [0049.020] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\X9FPcVHoENtd.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\x9fpcvhoentd.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.020] GetFileType (hFile=0x398) returned 0x1 [0049.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0049.020] GetFileType (hFile=0x398) returned 0x1 [0049.020] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0xe1b [0049.020] ReadFile (in: hFile=0x398, lpBuffer=0x2ef3d10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2ef3d10*, lpNumberOfBytesRead=0x10af2e4*=0xe1b, lpOverlapped=0x0) returned 1 [0049.039] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\X9FPcVHoENtd.docx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\X9FPcVHoENtd.docx.ForgiveME", lpFilePart=0x0) returned 0x41 [0049.040] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\X9FPcVHoENtd.docx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\x9fpcvhoentd.docx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.041] GetFileType (hFile=0x398) returned 0x1 [0049.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0049.041] GetFileType (hFile=0x398) returned 0x1 [0049.041] WriteFile (in: hFile=0x398, lpBuffer=0x2f46390*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2f46390*, lpNumberOfBytesWritten=0x10af2a8*=0xe20, lpOverlapped=0x0) returned 1 [0049.042] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\X9FPcVHoENtd.docx", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\X9FPcVHoENtd.docx", lpFilePart=0x0) returned 0x37 [0049.042] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\X9FPcVHoENtd.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\x9fpcvhoentd.docx")) returned 1 [0049.043] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\y F6C5d6r41imKRrNTOD.pptx", nBufferLength=0x105, lpBuffer=0x10aed3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\y F6C5d6r41imKRrNTOD.pptx", lpFilePart=0x0) returned 0x3f [0049.043] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\y F6C5d6r41imKRrNTOD.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\y f6c5d6r41imkrrntod.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.043] GetFileType (hFile=0x398) returned 0x1 [0049.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af22c) returned 1 [0049.043] GetFileType (hFile=0x398) returned 0x1 [0049.043] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af338 | out: lpFileSizeHigh=0x10af338*=0x0) returned 0x719b [0049.043] ReadFile (in: hFile=0x398, lpBuffer=0x2f47594, nNumberOfBytesToRead=0x719b, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2f47594*, lpNumberOfBytesRead=0x10af2e4*=0x719b, lpOverlapped=0x0) returned 1 [0049.059] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\y F6C5d6r41imKRrNTOD.pptx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\y F6C5d6r41imKRrNTOD.pptx.ForgiveME", lpFilePart=0x0) returned 0x49 [0049.059] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\y F6C5d6r41imKRrNTOD.pptx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\y f6c5d6r41imkrrntod.pptx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.059] GetFileType (hFile=0x398) returned 0x1 [0049.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af214) returned 1 [0049.059] GetFileType (hFile=0x398) returned 0x1 [0049.059] WriteFile (in: hFile=0x398, lpBuffer=0x2fb7c64*, nNumberOfBytesToWrite=0x71a0, lpNumberOfBytesWritten=0x10af2d4, lpOverlapped=0x0 | out: lpBuffer=0x2fb7c64*, lpNumberOfBytesWritten=0x10af2d4*=0x71a0, lpOverlapped=0x0) returned 1 [0049.061] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\y F6C5d6r41imKRrNTOD.pptx", nBufferLength=0x105, lpBuffer=0x10aee84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\y F6C5d6r41imKRrNTOD.pptx", lpFilePart=0x0) returned 0x3f [0049.061] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\y F6C5d6r41imKRrNTOD.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\y f6c5d6r41imkrrntod.pptx")) returned 1 [0049.062] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La", lpFilePart=0x0) returned 0x38 [0049.062] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\", lpFilePart=0x0) returned 0x39 [0049.062] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cb08 [0049.062] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.062] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.062] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.062] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.062] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.062] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.062] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.062] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.062] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.062] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.062] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.062] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0049.063] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0049.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0049.063] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La", lpFilePart=0x0) returned 0x38 [0049.063] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\", lpFilePart=0x0) returned 0x39 [0049.063] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cc08 [0049.063] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0049.063] FindClose (in: hFindFile=0x145cc08 | out: hFindFile=0x145cc08) returned 1 [0049.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0049.063] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\1BbnSx.csv", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\1BbnSx.csv", lpFilePart=0x0) returned 0x43 [0049.064] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\1BbnSx.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\1bbnsx.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.064] GetFileType (hFile=0x398) returned 0x1 [0049.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0049.064] GetFileType (hFile=0x398) returned 0x1 [0049.064] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x7e49 [0049.064] ReadFile (in: hFile=0x398, lpBuffer=0x2fc26fc, nNumberOfBytesToRead=0x7e49, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2fc26fc*, lpNumberOfBytesRead=0x10af2a8*=0x7e49, lpOverlapped=0x0) returned 1 [0049.080] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\1BbnSx.csv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\1BbnSx.csv.ForgiveME", lpFilePart=0x0) returned 0x4d [0049.080] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\1BbnSx.csv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\1bbnsx.csv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.080] GetFileType (hFile=0x398) returned 0x1 [0049.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0049.080] GetFileType (hFile=0x398) returned 0x1 [0049.080] WriteFile (in: hFile=0x398, lpBuffer=0x2e3f978*, nNumberOfBytesToWrite=0x7e50, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2e3f978*, lpNumberOfBytesWritten=0x10af298*=0x7e50, lpOverlapped=0x0) returned 1 [0049.081] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\1BbnSx.csv", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\1BbnSx.csv", lpFilePart=0x0) returned 0x43 [0049.081] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\1BbnSx.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\1bbnsx.csv")) returned 1 [0049.083] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\arSGYMgWT HKZJ1G.doc", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\arSGYMgWT HKZJ1G.doc", lpFilePart=0x0) returned 0x4d [0049.083] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\arSGYMgWT HKZJ1G.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\arsgymgwt hkzj1g.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.083] GetFileType (hFile=0x398) returned 0x1 [0049.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0049.083] GetFileType (hFile=0x398) returned 0x1 [0049.083] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0xf57c [0049.083] ReadFile (in: hFile=0x398, lpBuffer=0x2e47b88, nNumberOfBytesToRead=0xf57c, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2e47b88*, lpNumberOfBytesRead=0x10af2a8*=0xf57c, lpOverlapped=0x0) returned 1 [0049.098] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\arSGYMgWT HKZJ1G.doc.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\arSGYMgWT HKZJ1G.doc.ForgiveME", lpFilePart=0x0) returned 0x57 [0049.098] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\arSGYMgWT HKZJ1G.doc.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\arsgymgwt hkzj1g.doc.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.099] GetFileType (hFile=0x398) returned 0x1 [0049.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0049.099] GetFileType (hFile=0x398) returned 0x1 [0049.099] WriteFile (in: hFile=0x398, lpBuffer=0x2ec2c40*, nNumberOfBytesToWrite=0xf580, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2ec2c40*, lpNumberOfBytesWritten=0x10af298*=0xf580, lpOverlapped=0x0) returned 1 [0049.100] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\arSGYMgWT HKZJ1G.doc", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\arSGYMgWT HKZJ1G.doc", lpFilePart=0x0) returned 0x4d [0049.100] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\arSGYMgWT HKZJ1G.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\arsgymgwt hkzj1g.doc")) returned 1 [0049.102] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\HiEmRFvSq.xls", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\HiEmRFvSq.xls", lpFilePart=0x0) returned 0x46 [0049.102] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\HiEmRFvSq.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\hiemrfvsq.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.102] GetFileType (hFile=0x398) returned 0x1 [0049.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0049.102] GetFileType (hFile=0x398) returned 0x1 [0049.102] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x1120b [0049.102] ReadFile (in: hFile=0x398, lpBuffer=0x2ed254c, nNumberOfBytesToRead=0x1120b, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2ed254c*, lpNumberOfBytesRead=0x10af2a8*=0x1120b, lpOverlapped=0x0) returned 1 [0049.117] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\HiEmRFvSq.xls.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\HiEmRFvSq.xls.ForgiveME", lpFilePart=0x0) returned 0x50 [0049.117] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\HiEmRFvSq.xls.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\hiemrfvsq.xls.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.118] GetFileType (hFile=0x398) returned 0x1 [0049.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0049.118] GetFileType (hFile=0x398) returned 0x1 [0049.118] WriteFile (in: hFile=0x398, lpBuffer=0x2f52a50*, nNumberOfBytesToWrite=0x11210, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2f52a50*, lpNumberOfBytesWritten=0x10af298*=0x11210, lpOverlapped=0x0) returned 1 [0049.119] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\HiEmRFvSq.xls", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\HiEmRFvSq.xls", lpFilePart=0x0) returned 0x46 [0049.119] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\HiEmRFvSq.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\hiemrfvsq.xls")) returned 1 [0049.121] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\musy.doc", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\musy.doc", lpFilePart=0x0) returned 0x41 [0049.121] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\musy.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\musy.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.121] GetFileType (hFile=0x398) returned 0x1 [0049.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0049.121] GetFileType (hFile=0x398) returned 0x1 [0049.121] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x13f49 [0049.121] ReadFile (in: hFile=0x398, lpBuffer=0x2f63fb0, nNumberOfBytesToRead=0x13f49, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2f63fb0*, lpNumberOfBytesRead=0x10af2a8*=0x13f49, lpOverlapped=0x0) returned 1 [0049.137] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\musy.doc.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\musy.doc.ForgiveME", lpFilePart=0x0) returned 0x4b [0049.137] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\musy.doc.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\musy.doc.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.137] GetFileType (hFile=0x398) returned 0x1 [0049.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0049.137] GetFileType (hFile=0x398) returned 0x1 [0049.137] WriteFile (in: hFile=0x398, lpBuffer=0x2fecc68*, nNumberOfBytesToWrite=0x13f50, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2fecc68*, lpNumberOfBytesWritten=0x10af298*=0x13f50, lpOverlapped=0x0) returned 1 [0049.140] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\musy.doc", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\musy.doc", lpFilePart=0x0) returned 0x41 [0049.140] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\musy.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\musy.doc")) returned 1 [0049.141] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\OBFGJ0bztapq0816UG9F.xlsx", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\OBFGJ0bztapq0816UG9F.xlsx", lpFilePart=0x0) returned 0x52 [0049.141] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\OBFGJ0bztapq0816UG9F.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\obfgj0bztapq0816ug9f.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.141] GetFileType (hFile=0x398) returned 0x1 [0049.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0049.142] GetFileType (hFile=0x398) returned 0x1 [0049.142] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x124b5 [0049.142] ReadFile (in: hFile=0x398, lpBuffer=0x3000f2c, nNumberOfBytesToRead=0x124b5, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x3000f2c*, lpNumberOfBytesRead=0x10af2a8*=0x124b5, lpOverlapped=0x0) returned 1 [0049.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\OBFGJ0bztapq0816UG9F.xlsx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\OBFGJ0bztapq0816UG9F.xlsx.ForgiveME", lpFilePart=0x0) returned 0x5c [0049.158] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\OBFGJ0bztapq0816UG9F.xlsx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\obfgj0bztapq0816ug9f.xlsx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.159] GetFileType (hFile=0x398) returned 0x1 [0049.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0049.159] GetFileType (hFile=0x398) returned 0x1 [0049.159] WriteFile (in: hFile=0x398, lpBuffer=0x2ea1ccc*, nNumberOfBytesToWrite=0x124c0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2ea1ccc*, lpNumberOfBytesWritten=0x10af298*=0x124c0, lpOverlapped=0x0) returned 1 [0049.160] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\OBFGJ0bztapq0816UG9F.xlsx", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\OBFGJ0bztapq0816UG9F.xlsx", lpFilePart=0x0) returned 0x52 [0049.160] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\OBFGJ0bztapq0816UG9F.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\obfgj0bztapq0816ug9f.xlsx")) returned 1 [0049.162] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\oC6ovdu3E4B.rtf", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\oC6ovdu3E4B.rtf", lpFilePart=0x0) returned 0x48 [0049.162] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\oC6ovdu3E4B.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\oc6ovdu3e4b.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.162] GetFileType (hFile=0x398) returned 0x1 [0049.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0049.162] GetFileType (hFile=0x398) returned 0x1 [0049.162] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0xdfbd [0049.162] ReadFile (in: hFile=0x398, lpBuffer=0x2eb4540, nNumberOfBytesToRead=0xdfbd, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2eb4540*, lpNumberOfBytesRead=0x10af2a8*=0xdfbd, lpOverlapped=0x0) returned 1 [0049.177] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\oC6ovdu3E4B.rtf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\oC6ovdu3E4B.rtf.ForgiveME", lpFilePart=0x0) returned 0x52 [0049.177] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\oC6ovdu3E4B.rtf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\oc6ovdu3e4b.rtf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.178] GetFileType (hFile=0x398) returned 0x1 [0049.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0049.178] GetFileType (hFile=0x398) returned 0x1 [0049.178] WriteFile (in: hFile=0x398, lpBuffer=0x2f2b4b4*, nNumberOfBytesToWrite=0xdfc0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2f2b4b4*, lpNumberOfBytesWritten=0x10af298*=0xdfc0, lpOverlapped=0x0) returned 1 [0049.179] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\oC6ovdu3E4B.rtf", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\oC6ovdu3E4B.rtf", lpFilePart=0x0) returned 0x48 [0049.179] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\oC6ovdu3E4B.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\oc6ovdu3e4b.rtf")) returned 1 [0049.180] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\PV8 ISy6wTR2.doc", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\PV8 ISy6wTR2.doc", lpFilePart=0x0) returned 0x49 [0049.180] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\PV8 ISy6wTR2.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\pv8 isy6wtr2.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.181] GetFileType (hFile=0x398) returned 0x1 [0049.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0049.181] GetFileType (hFile=0x398) returned 0x1 [0049.181] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x9870 [0049.181] ReadFile (in: hFile=0x398, lpBuffer=0x2f397f0, nNumberOfBytesToRead=0x9870, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x2f397f0*, lpNumberOfBytesRead=0x10af2a8*=0x9870, lpOverlapped=0x0) returned 1 [0049.195] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\PV8 ISy6wTR2.doc.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\PV8 ISy6wTR2.doc.ForgiveME", lpFilePart=0x0) returned 0x53 [0049.195] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\PV8 ISy6wTR2.doc.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\pv8 isy6wtr2.doc.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.196] GetFileType (hFile=0x398) returned 0x1 [0049.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0049.196] GetFileType (hFile=0x398) returned 0x1 [0049.196] WriteFile (in: hFile=0x398, lpBuffer=0x2fb6130*, nNumberOfBytesToWrite=0x9880, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x2fb6130*, lpNumberOfBytesWritten=0x10af298*=0x9880, lpOverlapped=0x0) returned 1 [0049.197] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\PV8 ISy6wTR2.doc", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\PV8 ISy6wTR2.doc", lpFilePart=0x0) returned 0x49 [0049.197] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\PV8 ISy6wTR2.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\pv8 isy6wtr2.doc")) returned 1 [0049.217] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\vOUWp70l.docx", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\vOUWp70l.docx", lpFilePart=0x0) returned 0x46 [0049.217] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\vOUWp70l.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\vouwp70l.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.217] GetFileType (hFile=0x398) returned 0x1 [0049.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0049.217] GetFileType (hFile=0x398) returned 0x1 [0049.217] GetFileSize (in: hFile=0x398, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x15c1c [0049.217] ReadFile (in: hFile=0x398, lpBuffer=0x3ee1c70, nNumberOfBytesToRead=0x15c1c, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x3ee1c70*, lpNumberOfBytesRead=0x10af2a8*=0x15c1c, lpOverlapped=0x0) returned 1 [0049.233] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\vOUWp70l.docx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\vOUWp70l.docx.ForgiveME", lpFilePart=0x0) returned 0x50 [0049.233] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\vOUWp70l.docx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\vouwp70l.docx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0049.233] GetFileType (hFile=0x398) returned 0x1 [0049.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0049.234] GetFileType (hFile=0x398) returned 0x1 [0049.234] WriteFile (in: hFile=0x398, lpBuffer=0x3f4e948*, nNumberOfBytesToWrite=0x15c20, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x3f4e948*, lpNumberOfBytesWritten=0x10af298*=0x15c20, lpOverlapped=0x0) returned 1 [0049.235] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\vOUWp70l.docx", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\vOUWp70l.docx", lpFilePart=0x0) returned 0x46 [0049.235] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\fhaya\\valz3-3cOWwPU0u8La\\vOUWp70l.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\fhaya\\valz3-3cowwpu0u8la\\vouwp70l.docx")) returned 1 [0049.237] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music", lpFilePart=0x0) returned 0x28 [0049.237] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\", lpFilePart=0x0) returned 0x29 [0049.237] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0xffffffff [0049.261] EtwEventRegister (in: ProviderId=0x300f060, EnableCallback=0x54905fe, CallbackContext=0x0, RegHandle=0x300f03c | out: RegHandle=0x300f03c) returned 0x0 [0049.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0049.274] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures", lpFilePart=0x0) returned 0x2b [0049.274] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x2c [0049.274] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0xffffffff [0049.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af310) returned 1 [0049.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0049.275] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpFilePart=0x0) returned 0x29 [0049.275] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x2a [0049.275] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c748 [0049.276] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.277] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.277] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.277] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.277] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0049.277] FindClose (in: hFindFile=0x145c748 | out: hFindFile=0x145c748) returned 1 [0049.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0049.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af318) returned 1 [0049.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0049.277] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpFilePart=0x0) returned 0x29 [0049.277] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x2a [0049.277] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145cb08 [0049.277] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.278] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.278] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.278] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.278] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0049.278] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0049.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0049.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af318) returned 1 [0049.281] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x32 [0049.281] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x33 [0049.281] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cb08 [0049.282] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.282] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.282] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0049.282] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0049.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0049.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0049.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0049.282] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x32 [0049.282] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x33 [0049.282] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cb88 [0049.283] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.283] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.283] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0049.283] FindClose (in: hFindFile=0x145cb88 | out: hFindFile=0x145cb88) returned 1 [0049.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0049.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0049.283] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x3d [0049.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1f4) returned 1 [0049.283] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.283] GetFileType (hFile=0x39c) returned 0x1 [0049.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0049.283] GetFileType (hFile=0x39c) returned 0x1 [0049.283] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x74e6 [0049.283] ReadFile (in: hFile=0x39c, lpBuffer=0x3013eb0, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x3013eb0*, lpNumberOfBytesRead=0x10af2a8*=0x74e6, lpOverlapped=0x0) returned 1 [0049.284] CloseHandle (hObject=0x39c) returned 1 [0049.319] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico.ForgiveME", lpFilePart=0x0) returned 0x47 [0049.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1dc) returned 1 [0049.319] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.320] GetFileType (hFile=0x39c) returned 0x1 [0049.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0049.320] GetFileType (hFile=0x39c) returned 0x1 [0049.320] WriteFile (in: hFile=0x39c, lpBuffer=0x308560c*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x308560c*, lpNumberOfBytesWritten=0x10af298*=0x74f0, lpOverlapped=0x0) returned 1 [0049.321] CloseHandle (hObject=0x39c) returned 1 [0049.322] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x3d [0049.322] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico")) returned 1 [0049.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0049.323] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos", lpFilePart=0x0) returned 0x29 [0049.323] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x2a [0049.323] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0xffffffff [0049.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af310) returned 1 [0049.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0049.324] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpFilePart=0x0) returned 0x31 [0049.324] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpFilePart=0x0) returned 0x32 [0049.324] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c748 [0049.325] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.325] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.325] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0049.325] FindClose (in: hFindFile=0x145c748 | out: hFindFile=0x145c748) returned 1 [0049.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0049.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af318) returned 1 [0049.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0049.326] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpFilePart=0x0) returned 0x31 [0049.326] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\", lpFilePart=0x0) returned 0x32 [0049.326] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145ce08 [0049.326] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.326] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.326] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0049.326] FindClose (in: hFindFile=0x145ce08 | out: hFindFile=0x145ce08) returned 1 [0049.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0049.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af318) returned 1 [0049.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0049.326] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpFilePart=0x0) returned 0x3d [0049.326] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\", lpFilePart=0x0) returned 0x3e [0049.327] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c788 [0049.327] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.327] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.327] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.327] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0049.327] FindClose (in: hFindFile=0x145c788 | out: hFindFile=0x145c788) returned 1 [0049.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0049.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0049.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0049.328] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook", lpFilePart=0x0) returned 0x3d [0049.328] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\", lpFilePart=0x0) returned 0x3e [0049.328] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c748 [0049.328] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.328] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.328] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0049.328] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0049.328] FindClose (in: hFindFile=0x145c748 | out: hFindFile=0x145c748) returned 1 [0049.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0049.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0049.329] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d [0049.329] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x2e [0049.329] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c888 [0049.330] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.330] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.330] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0049.330] FindClose (in: hFindFile=0x145c888 | out: hFindFile=0x145c888) returned 1 [0049.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0049.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af318) returned 1 [0049.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0049.331] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d [0049.331] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x2e [0049.331] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145cdc8 [0049.331] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.331] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0049.331] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0049.331] FindClose (in: hFindFile=0x145cdc8 | out: hFindFile=0x145cdc8) returned 1 [0049.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0049.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af318) returned 1 [0049.331] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x10aee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0049.331] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x10aee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x26 [0049.331] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*", lpFindFileData=0x10af0b0 | out: lpFindFileData=0x10af0b0) returned 0x145c888 [0049.332] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.332] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.332] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.332] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.332] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.332] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.332] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.332] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.332] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.333] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.333] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.333] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.333] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.333] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.333] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.333] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.333] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.333] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.333] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.334] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.334] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.334] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.334] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.334] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.334] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.334] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.334] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.334] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.335] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.335] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.335] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.335] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.335] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.335] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.335] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.335] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.335] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.335] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.335] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.336] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.336] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.336] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.336] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.336] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.336] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.336] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.336] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.336] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.336] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 0 [0049.336] FindClose (in: hFindFile=0x145c888 | out: hFindFile=0x145c888) returned 1 [0049.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af348) returned 1 [0049.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af354) returned 1 [0049.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af388) returned 1 [0049.337] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x10aee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0049.337] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x10aee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x26 [0049.337] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\*", lpFindFileData=0x10af0b0 | out: lpFindFileData=0x10af0b0) returned 0x145cb88 [0049.337] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.337] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.337] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.337] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.337] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.337] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.338] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.338] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.338] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.338] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.338] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.338] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.338] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.339] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.339] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.339] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.339] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.339] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.339] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.339] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.339] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.339] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.340] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.341] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.341] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.341] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.341] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.341] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.341] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.341] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.341] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.341] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.341] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 1 [0049.341] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af0c0 | out: lpFindFileData=0x10af0c0) returned 0 [0049.341] FindClose (in: hFindFile=0x145cb88 | out: hFindFile=0x145cb88) returned 1 [0049.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af348) returned 1 [0049.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af354) returned 1 [0049.341] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\-v8NyVF6Hq8N 4.flv", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\-v8NyVF6Hq8N 4.flv", lpFilePart=0x0) returned 0x38 [0049.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af26c) returned 1 [0049.341] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\-v8NyVF6Hq8N 4.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\-v8nyvf6hq8n 4.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.341] GetFileType (hFile=0x39c) returned 0x1 [0049.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.341] GetFileType (hFile=0x39c) returned 0x1 [0049.341] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x11a4 [0049.342] ReadFile (in: hFile=0x39c, lpBuffer=0x309b0d8, nNumberOfBytesToRead=0x11a4, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x309b0d8*, lpNumberOfBytesRead=0x10af320*=0x11a4, lpOverlapped=0x0) returned 1 [0049.342] CloseHandle (hObject=0x39c) returned 1 [0049.363] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\-v8NyVF6Hq8N 4.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\-v8NyVF6Hq8N 4.flv.ForgiveME", lpFilePart=0x0) returned 0x42 [0049.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af254) returned 1 [0049.363] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\-v8NyVF6Hq8N 4.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\-v8nyvf6hq8n 4.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.363] GetFileType (hFile=0x39c) returned 0x1 [0049.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.364] GetFileType (hFile=0x39c) returned 0x1 [0049.364] WriteFile (in: hFile=0x39c, lpBuffer=0x2e403e8*, nNumberOfBytesToWrite=0x11b0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e403e8*, lpNumberOfBytesWritten=0x10af310*=0x11b0, lpOverlapped=0x0) returned 1 [0049.364] CloseHandle (hObject=0x39c) returned 1 [0049.365] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\-v8NyVF6Hq8N 4.flv", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\-v8NyVF6Hq8N 4.flv", lpFilePart=0x0) returned 0x38 [0049.365] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\-v8NyVF6Hq8N 4.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\-v8nyvf6hq8n 4.flv")) returned 1 [0049.366] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\17eykEheY.rtf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\17eykEheY.rtf", lpFilePart=0x0) returned 0x33 [0049.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af26c) returned 1 [0049.366] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\17eykEheY.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\17eykehey.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.366] GetFileType (hFile=0x39c) returned 0x1 [0049.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.366] GetFileType (hFile=0x39c) returned 0x1 [0049.366] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xaa8c [0049.366] ReadFile (in: hFile=0x39c, lpBuffer=0x2e418a8, nNumberOfBytesToRead=0xaa8c, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e418a8*, lpNumberOfBytesRead=0x10af320*=0xaa8c, lpOverlapped=0x0) returned 1 [0049.382] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\17eykEheY.rtf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\17eykEheY.rtf.ForgiveME", lpFilePart=0x0) returned 0x3d [0049.382] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\17eykEheY.rtf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\17eykehey.rtf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.382] GetFileType (hFile=0x39c) returned 0x1 [0049.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.382] GetFileType (hFile=0x39c) returned 0x1 [0049.382] WriteFile (in: hFile=0x39c, lpBuffer=0x2eae85c*, nNumberOfBytesToWrite=0xaa90, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2eae85c*, lpNumberOfBytesWritten=0x10af310*=0xaa90, lpOverlapped=0x0) returned 1 [0049.384] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\17eykEheY.rtf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\17eykEheY.rtf", lpFilePart=0x0) returned 0x33 [0049.384] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\17eykEheY.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\17eykehey.rtf")) returned 1 [0049.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3haeIb.doc", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3haeIb.doc", lpFilePart=0x0) returned 0x30 [0049.386] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3haeIb.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\3haeib.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.386] GetFileType (hFile=0x39c) returned 0x1 [0049.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.386] GetFileType (hFile=0x39c) returned 0x1 [0049.386] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x16c8c [0049.386] ReadFile (in: hFile=0x39c, lpBuffer=0x3f79aa8, nNumberOfBytesToRead=0x16c8c, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3f79aa8*, lpNumberOfBytesRead=0x10af320*=0x16c8c, lpOverlapped=0x0) returned 1 [0049.402] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3haeIb.doc.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3haeIb.doc.ForgiveME", lpFilePart=0x0) returned 0x3a [0049.402] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3haeIb.doc.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\3haeib.doc.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.403] GetFileType (hFile=0x39c) returned 0x1 [0049.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.403] GetFileType (hFile=0x39c) returned 0x1 [0049.403] WriteFile (in: hFile=0x39c, lpBuffer=0x3feb9b0*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3feb9b0*, lpNumberOfBytesWritten=0x10af310*=0x16c90, lpOverlapped=0x0) returned 1 [0049.404] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3haeIb.doc", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3haeIb.doc", lpFilePart=0x0) returned 0x30 [0049.404] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3haeIb.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\3haeib.doc")) returned 1 [0049.406] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3smmnKCEcJDj6_ RTfaY.mp4", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3smmnKCEcJDj6_ RTfaY.mp4", lpFilePart=0x0) returned 0x3e [0049.406] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3smmnKCEcJDj6_ RTfaY.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\3smmnkcecjdj6_ rtfay.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.406] GetFileType (hFile=0x39c) returned 0x1 [0049.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.406] GetFileType (hFile=0x39c) returned 0x1 [0049.406] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x484b [0049.406] ReadFile (in: hFile=0x39c, lpBuffer=0x2f06778, nNumberOfBytesToRead=0x484b, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f06778*, lpNumberOfBytesRead=0x10af320*=0x484b, lpOverlapped=0x0) returned 1 [0049.420] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3smmnKCEcJDj6_ RTfaY.mp4.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3smmnKCEcJDj6_ RTfaY.mp4.ForgiveME", lpFilePart=0x0) returned 0x48 [0049.420] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3smmnKCEcJDj6_ RTfaY.mp4.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\3smmnkcecjdj6_ rtfay.mp4.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.421] GetFileType (hFile=0x39c) returned 0x1 [0049.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.421] GetFileType (hFile=0x39c) returned 0x1 [0049.421] WriteFile (in: hFile=0x39c, lpBuffer=0x2f69fb8*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f69fb8*, lpNumberOfBytesWritten=0x10af310*=0x4850, lpOverlapped=0x0) returned 1 [0049.422] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3smmnKCEcJDj6_ RTfaY.mp4", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3smmnKCEcJDj6_ RTfaY.mp4", lpFilePart=0x0) returned 0x3e [0049.422] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\3smmnKCEcJDj6_ RTfaY.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\3smmnkcecjdj6_ rtfay.mp4")) returned 1 [0049.423] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5J MtzDz55CsqSu.mp3", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5J MtzDz55CsqSu.mp3", lpFilePart=0x0) returned 0x39 [0049.423] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5J MtzDz55CsqSu.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\5j mtzdz55csqsu.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.423] GetFileType (hFile=0x39c) returned 0x1 [0049.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.423] GetFileType (hFile=0x39c) returned 0x1 [0049.423] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x1120b [0049.423] ReadFile (in: hFile=0x39c, lpBuffer=0x2f6eb54, nNumberOfBytesToRead=0x1120b, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f6eb54*, lpNumberOfBytesRead=0x10af320*=0x1120b, lpOverlapped=0x0) returned 1 [0049.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5J MtzDz55CsqSu.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5J MtzDz55CsqSu.mp3.ForgiveME", lpFilePart=0x0) returned 0x43 [0049.438] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5J MtzDz55CsqSu.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\5j mtzdz55csqsu.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.439] GetFileType (hFile=0x39c) returned 0x1 [0049.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.439] GetFileType (hFile=0x39c) returned 0x1 [0049.439] WriteFile (in: hFile=0x39c, lpBuffer=0x2fef03c*, nNumberOfBytesToWrite=0x11210, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fef03c*, lpNumberOfBytesWritten=0x10af310*=0x11210, lpOverlapped=0x0) returned 1 [0049.440] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5J MtzDz55CsqSu.mp3", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5J MtzDz55CsqSu.mp3", lpFilePart=0x0) returned 0x39 [0049.440] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5J MtzDz55CsqSu.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\5j mtzdz55csqsu.mp3")) returned 1 [0049.442] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6g6Tu-mG89sgywJ-Y.jpg", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6g6Tu-mG89sgywJ-Y.jpg", lpFilePart=0x0) returned 0x3b [0049.442] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6g6Tu-mG89sgywJ-Y.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6g6tu-mg89sgywj-y.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.442] GetFileType (hFile=0x39c) returned 0x1 [0049.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.442] GetFileType (hFile=0x39c) returned 0x1 [0049.442] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xc3d5 [0049.442] ReadFile (in: hFile=0x39c, lpBuffer=0x300057c, nNumberOfBytesToRead=0xc3d5, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x300057c*, lpNumberOfBytesRead=0x10af320*=0xc3d5, lpOverlapped=0x0) returned 1 [0049.459] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6g6Tu-mG89sgywJ-Y.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6g6Tu-mG89sgywJ-Y.jpg.ForgiveME", lpFilePart=0x0) returned 0x45 [0049.459] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6g6Tu-mG89sgywJ-Y.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6g6tu-mg89sgywj-y.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.459] GetFileType (hFile=0x39c) returned 0x1 [0049.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.459] GetFileType (hFile=0x39c) returned 0x1 [0049.459] WriteFile (in: hFile=0x39c, lpBuffer=0x2e7d208*, nNumberOfBytesToWrite=0xc3e0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e7d208*, lpNumberOfBytesWritten=0x10af310*=0xc3e0, lpOverlapped=0x0) returned 1 [0049.460] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6g6Tu-mG89sgywJ-Y.jpg", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6g6Tu-mG89sgywJ-Y.jpg", lpFilePart=0x0) returned 0x3b [0049.460] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\6g6Tu-mG89sgywJ-Y.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\6g6tu-mg89sgywj-y.jpg")) returned 1 [0049.462] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7XuUFJRJ.swf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7XuUFJRJ.swf", lpFilePart=0x0) returned 0x32 [0049.462] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7XuUFJRJ.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\7xuufjrj.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.462] GetFileType (hFile=0x39c) returned 0x1 [0049.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.462] GetFileType (hFile=0x39c) returned 0x1 [0049.462] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xb42c [0049.462] ReadFile (in: hFile=0x39c, lpBuffer=0x2e89904, nNumberOfBytesToRead=0xb42c, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e89904*, lpNumberOfBytesRead=0x10af320*=0xb42c, lpOverlapped=0x0) returned 1 [0049.477] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7XuUFJRJ.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7XuUFJRJ.swf.ForgiveME", lpFilePart=0x0) returned 0x3c [0049.477] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7XuUFJRJ.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\7xuufjrj.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.478] GetFileType (hFile=0x39c) returned 0x1 [0049.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.478] GetFileType (hFile=0x39c) returned 0x1 [0049.478] WriteFile (in: hFile=0x39c, lpBuffer=0x2ef8598*, nNumberOfBytesToWrite=0xb430, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2ef8598*, lpNumberOfBytesWritten=0x10af310*=0xb430, lpOverlapped=0x0) returned 1 [0049.482] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7XuUFJRJ.swf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7XuUFJRJ.swf", lpFilePart=0x0) returned 0x32 [0049.482] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7XuUFJRJ.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\7xuufjrj.swf")) returned 1 [0049.483] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8Hs0N-sb7ZG.bmp", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8Hs0N-sb7ZG.bmp", lpFilePart=0x0) returned 0x35 [0049.483] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8Hs0N-sb7ZG.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\8hs0n-sb7zg.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.484] GetFileType (hFile=0x39c) returned 0x1 [0049.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.484] GetFileType (hFile=0x39c) returned 0x1 [0049.484] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xedbf [0049.484] ReadFile (in: hFile=0x39c, lpBuffer=0x2f03cbc, nNumberOfBytesToRead=0xedbf, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f03cbc*, lpNumberOfBytesRead=0x10af320*=0xedbf, lpOverlapped=0x0) returned 1 [0049.499] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8Hs0N-sb7ZG.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8Hs0N-sb7ZG.bmp.ForgiveME", lpFilePart=0x0) returned 0x3f [0049.499] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8Hs0N-sb7ZG.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\8hs0n-sb7zg.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.499] GetFileType (hFile=0x39c) returned 0x1 [0049.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.500] GetFileType (hFile=0x39c) returned 0x1 [0049.500] WriteFile (in: hFile=0x39c, lpBuffer=0x2f7d4ac*, nNumberOfBytesToWrite=0xedc0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f7d4ac*, lpNumberOfBytesWritten=0x10af310*=0xedc0, lpOverlapped=0x0) returned 1 [0049.501] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8Hs0N-sb7ZG.bmp", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8Hs0N-sb7ZG.bmp", lpFilePart=0x0) returned 0x35 [0049.501] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\8Hs0N-sb7ZG.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\8hs0n-sb7zg.bmp")) returned 1 [0049.502] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9c7whM0Y2A.swf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9c7whM0Y2A.swf", lpFilePart=0x0) returned 0x34 [0049.502] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9c7whM0Y2A.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\9c7whm0y2a.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.502] GetFileType (hFile=0x39c) returned 0x1 [0049.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.502] GetFileType (hFile=0x39c) returned 0x1 [0049.502] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x17220 [0049.502] ReadFile (in: hFile=0x39c, lpBuffer=0x4071620, nNumberOfBytesToRead=0x17220, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x4071620*, lpNumberOfBytesRead=0x10af320*=0x17220, lpOverlapped=0x0) returned 1 [0049.521] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9c7whM0Y2A.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9c7whM0Y2A.swf.ForgiveME", lpFilePart=0x0) returned 0x3e [0049.521] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9c7whM0Y2A.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\9c7whm0y2a.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.521] GetFileType (hFile=0x39c) returned 0x1 [0049.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.521] GetFileType (hFile=0x39c) returned 0x1 [0049.522] WriteFile (in: hFile=0x39c, lpBuffer=0x40e5140*, nNumberOfBytesToWrite=0x17230, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x40e5140*, lpNumberOfBytesWritten=0x10af310*=0x17230, lpOverlapped=0x0) returned 1 [0049.523] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9c7whM0Y2A.swf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9c7whM0Y2A.swf", lpFilePart=0x0) returned 0x34 [0049.523] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9c7whM0Y2A.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\9c7whm0y2a.swf")) returned 1 [0049.524] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9dx1aYv7.mkv", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9dx1aYv7.mkv", lpFilePart=0x0) returned 0x32 [0049.524] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9dx1aYv7.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\9dx1ayv7.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.524] GetFileType (hFile=0x39c) returned 0x1 [0049.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.525] GetFileType (hFile=0x39c) returned 0x1 [0049.525] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x129f0 [0049.525] ReadFile (in: hFile=0x39c, lpBuffer=0x2fd9710, nNumberOfBytesToRead=0x129f0, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2fd9710*, lpNumberOfBytesRead=0x10af320*=0x129f0, lpOverlapped=0x0) returned 1 [0049.553] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9dx1aYv7.mkv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9dx1aYv7.mkv.ForgiveME", lpFilePart=0x0) returned 0x3c [0049.554] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9dx1aYv7.mkv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\9dx1ayv7.mkv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.554] GetFileType (hFile=0x39c) returned 0x1 [0049.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.554] GetFileType (hFile=0x39c) returned 0x1 [0049.554] WriteFile (in: hFile=0x39c, lpBuffer=0x2e41c20*, nNumberOfBytesToWrite=0x12a00, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e41c20*, lpNumberOfBytesWritten=0x10af310*=0x12a00, lpOverlapped=0x0) returned 1 [0049.555] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9dx1aYv7.mkv", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9dx1aYv7.mkv", lpFilePart=0x0) returned 0x32 [0049.555] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\9dx1aYv7.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\9dx1ayv7.mkv")) returned 1 [0049.557] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Auh9h1.mp3", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Auh9h1.mp3", lpFilePart=0x0) returned 0x30 [0049.557] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Auh9h1.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\auh9h1.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.557] GetFileType (hFile=0x39c) returned 0x1 [0049.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.557] GetFileType (hFile=0x39c) returned 0x1 [0049.557] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x3a9b [0049.557] ReadFile (in: hFile=0x39c, lpBuffer=0x2e54904, nNumberOfBytesToRead=0x3a9b, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e54904*, lpNumberOfBytesRead=0x10af320*=0x3a9b, lpOverlapped=0x0) returned 1 [0049.571] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Auh9h1.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Auh9h1.mp3.ForgiveME", lpFilePart=0x0) returned 0x3a [0049.571] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Auh9h1.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\auh9h1.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.572] GetFileType (hFile=0x39c) returned 0x1 [0049.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.572] GetFileType (hFile=0x39c) returned 0x1 [0049.572] WriteFile (in: hFile=0x39c, lpBuffer=0x2eb3e14*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2eb3e14*, lpNumberOfBytesWritten=0x10af310*=0x3aa0, lpOverlapped=0x0) returned 1 [0049.573] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Auh9h1.mp3", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Auh9h1.mp3", lpFilePart=0x0) returned 0x30 [0049.573] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Auh9h1.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\auh9h1.mp3")) returned 1 [0049.574] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cQQm2Dw6.ppt", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cQQm2Dw6.ppt", lpFilePart=0x0) returned 0x32 [0049.574] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cQQm2Dw6.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cqqm2dw6.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.574] GetFileType (hFile=0x39c) returned 0x1 [0049.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.575] GetFileType (hFile=0x39c) returned 0x1 [0049.575] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x1ab7 [0049.575] ReadFile (in: hFile=0x39c, lpBuffer=0x2eb7b94, nNumberOfBytesToRead=0x1ab7, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2eb7b94*, lpNumberOfBytesRead=0x10af320*=0x1ab7, lpOverlapped=0x0) returned 1 [0049.588] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cQQm2Dw6.ppt.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cQQm2Dw6.ppt.ForgiveME", lpFilePart=0x0) returned 0x3c [0049.589] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cQQm2Dw6.ppt.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cqqm2dw6.ppt.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.589] GetFileType (hFile=0x39c) returned 0x1 [0049.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.589] GetFileType (hFile=0x39c) returned 0x1 [0049.589] WriteFile (in: hFile=0x39c, lpBuffer=0x2f0cfec*, nNumberOfBytesToWrite=0x1ac0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f0cfec*, lpNumberOfBytesWritten=0x10af310*=0x1ac0, lpOverlapped=0x0) returned 1 [0049.590] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cQQm2Dw6.ppt", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cQQm2Dw6.ppt", lpFilePart=0x0) returned 0x32 [0049.590] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cQQm2Dw6.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cqqm2dw6.ppt")) returned 1 [0049.591] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dNli6PfdKcu.pps", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dNli6PfdKcu.pps", lpFilePart=0x0) returned 0x35 [0049.591] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dNli6PfdKcu.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dnli6pfdkcu.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.591] GetFileType (hFile=0x39c) returned 0x1 [0049.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.591] GetFileType (hFile=0x39c) returned 0x1 [0049.591] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x4707 [0049.591] ReadFile (in: hFile=0x39c, lpBuffer=0x2f0eda0, nNumberOfBytesToRead=0x4707, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f0eda0*, lpNumberOfBytesRead=0x10af320*=0x4707, lpOverlapped=0x0) returned 1 [0049.605] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dNli6PfdKcu.pps.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dNli6PfdKcu.pps.ForgiveME", lpFilePart=0x0) returned 0x3f [0049.605] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dNli6PfdKcu.pps.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dnli6pfdkcu.pps.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.606] GetFileType (hFile=0x39c) returned 0x1 [0049.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.606] GetFileType (hFile=0x39c) returned 0x1 [0049.606] WriteFile (in: hFile=0x39c, lpBuffer=0x2f71f8c*, nNumberOfBytesToWrite=0x4710, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f71f8c*, lpNumberOfBytesWritten=0x10af310*=0x4710, lpOverlapped=0x0) returned 1 [0049.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dNli6PfdKcu.pps", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dNli6PfdKcu.pps", lpFilePart=0x0) returned 0x35 [0049.607] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\dNli6PfdKcu.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\dnli6pfdkcu.pps")) returned 1 [0049.608] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\EPaG YyKvHjNiubBMW.gif", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\EPaG YyKvHjNiubBMW.gif", lpFilePart=0x0) returned 0x3c [0049.608] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\EPaG YyKvHjNiubBMW.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\epag yykvhjniubbmw.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.608] GetFileType (hFile=0x39c) returned 0x1 [0049.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.608] GetFileType (hFile=0x39c) returned 0x1 [0049.608] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x4ab [0049.608] ReadFile (in: hFile=0x39c, lpBuffer=0x2f76e74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f76e74*, lpNumberOfBytesRead=0x10af320*=0x4ab, lpOverlapped=0x0) returned 1 [0049.622] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\EPaG YyKvHjNiubBMW.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\EPaG YyKvHjNiubBMW.gif.ForgiveME", lpFilePart=0x0) returned 0x46 [0049.622] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\EPaG YyKvHjNiubBMW.gif.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\epag yykvhjniubbmw.gif.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.622] GetFileType (hFile=0x39c) returned 0x1 [0049.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.622] GetFileType (hFile=0x39c) returned 0x1 [0049.622] WriteFile (in: hFile=0x39c, lpBuffer=0x2fc65e8*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x2fc65e8*, lpNumberOfBytesWritten=0x10af2e4*=0x4b0, lpOverlapped=0x0) returned 1 [0049.623] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\EPaG YyKvHjNiubBMW.gif", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\EPaG YyKvHjNiubBMW.gif", lpFilePart=0x0) returned 0x3c [0049.623] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\EPaG YyKvHjNiubBMW.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\epag yykvhjniubbmw.gif")) returned 1 [0049.624] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\fNQMm1datx 9EskaR6.swf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\fNQMm1datx 9EskaR6.swf", lpFilePart=0x0) returned 0x3c [0049.625] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\fNQMm1datx 9EskaR6.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\fnqmm1datx 9eskar6.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.625] GetFileType (hFile=0x39c) returned 0x1 [0049.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.625] GetFileType (hFile=0x39c) returned 0x1 [0049.625] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x16aa1 [0049.625] ReadFile (in: hFile=0x39c, lpBuffer=0x3e1ecd0, nNumberOfBytesToRead=0x16aa1, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3e1ecd0*, lpNumberOfBytesRead=0x10af320*=0x16aa1, lpOverlapped=0x0) returned 1 [0049.645] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\fNQMm1datx 9EskaR6.swf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\fNQMm1datx 9EskaR6.swf.ForgiveME", lpFilePart=0x0) returned 0x46 [0049.645] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\fNQMm1datx 9EskaR6.swf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\fnqmm1datx 9eskar6.swf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.646] GetFileType (hFile=0x39c) returned 0x1 [0049.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.646] GetFileType (hFile=0x39c) returned 0x1 [0049.646] WriteFile (in: hFile=0x39c, lpBuffer=0x3e90270*, nNumberOfBytesToWrite=0x16ab0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3e90270*, lpNumberOfBytesWritten=0x10af310*=0x16ab0, lpOverlapped=0x0) returned 1 [0049.648] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\fNQMm1datx 9EskaR6.swf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\fNQMm1datx 9EskaR6.swf", lpFilePart=0x0) returned 0x3c [0049.648] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\fNQMm1datx 9EskaR6.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\fnqmm1datx 9eskar6.swf")) returned 1 [0049.649] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HVzjHTIsAHo0uBqX3uQ.rtf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HVzjHTIsAHo0uBqX3uQ.rtf", lpFilePart=0x0) returned 0x3d [0049.649] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HVzjHTIsAHo0uBqX3uQ.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hvzjhtisaho0ubqx3uq.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.649] GetFileType (hFile=0x39c) returned 0x1 [0049.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.649] GetFileType (hFile=0x39c) returned 0x1 [0049.649] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xcda9 [0049.649] ReadFile (in: hFile=0x39c, lpBuffer=0x30149fc, nNumberOfBytesToRead=0xcda9, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x30149fc*, lpNumberOfBytesRead=0x10af320*=0xcda9, lpOverlapped=0x0) returned 1 [0049.668] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HVzjHTIsAHo0uBqX3uQ.rtf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HVzjHTIsAHo0uBqX3uQ.rtf.ForgiveME", lpFilePart=0x0) returned 0x47 [0049.668] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HVzjHTIsAHo0uBqX3uQ.rtf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hvzjhtisaho0ubqx3uq.rtf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.669] GetFileType (hFile=0x39c) returned 0x1 [0049.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.669] GetFileType (hFile=0x39c) returned 0x1 [0049.669] WriteFile (in: hFile=0x39c, lpBuffer=0x30881cc*, nNumberOfBytesToWrite=0xcdb0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x30881cc*, lpNumberOfBytesWritten=0x10af310*=0xcdb0, lpOverlapped=0x0) returned 1 [0049.670] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HVzjHTIsAHo0uBqX3uQ.rtf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HVzjHTIsAHo0uBqX3uQ.rtf", lpFilePart=0x0) returned 0x3d [0049.670] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\HVzjHTIsAHo0uBqX3uQ.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\hvzjhtisaho0ubqx3uq.rtf")) returned 1 [0049.672] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IosxXJYbUxIWxskr7.png", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IosxXJYbUxIWxskr7.png", lpFilePart=0x0) returned 0x3b [0049.672] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IosxXJYbUxIWxskr7.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\iosxxjybuxiwxskr7.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.672] GetFileType (hFile=0x39c) returned 0x1 [0049.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.672] GetFileType (hFile=0x39c) returned 0x1 [0049.672] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xec7 [0049.672] ReadFile (in: hFile=0x39c, lpBuffer=0x3096198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3096198*, lpNumberOfBytesRead=0x10af320*=0xec7, lpOverlapped=0x0) returned 1 [0049.687] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IosxXJYbUxIWxskr7.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IosxXJYbUxIWxskr7.png.ForgiveME", lpFilePart=0x0) returned 0x45 [0049.688] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IosxXJYbUxIWxskr7.png.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\iosxxjybuxiwxskr7.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.688] GetFileType (hFile=0x39c) returned 0x1 [0049.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.688] GetFileType (hFile=0x39c) returned 0x1 [0049.688] WriteFile (in: hFile=0x39c, lpBuffer=0x30e8ba4*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x30e8ba4*, lpNumberOfBytesWritten=0x10af2e4*=0xed0, lpOverlapped=0x0) returned 1 [0049.689] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IosxXJYbUxIWxskr7.png", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IosxXJYbUxIWxskr7.png", lpFilePart=0x0) returned 0x3b [0049.689] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IosxXJYbUxIWxskr7.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\iosxxjybuxiwxskr7.png")) returned 1 [0049.690] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IrJUSoID3NrK4M4p.xlsx", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IrJUSoID3NrK4M4p.xlsx", lpFilePart=0x0) returned 0x3b [0049.690] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IrJUSoID3NrK4M4p.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\irjusoid3nrk4m4p.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.690] GetFileType (hFile=0x39c) returned 0x1 [0049.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.691] GetFileType (hFile=0x39c) returned 0x1 [0049.691] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x14be2 [0049.691] ReadFile (in: hFile=0x39c, lpBuffer=0x30e9da0, nNumberOfBytesToRead=0x14be2, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x30e9da0*, lpNumberOfBytesRead=0x10af320*=0x14be2, lpOverlapped=0x0) returned 1 [0049.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IrJUSoID3NrK4M4p.xlsx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IrJUSoID3NrK4M4p.xlsx.ForgiveME", lpFilePart=0x0) returned 0x45 [0049.715] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IrJUSoID3NrK4M4p.xlsx.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\irjusoid3nrk4m4p.xlsx.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.715] GetFileType (hFile=0x39c) returned 0x1 [0049.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.716] GetFileType (hFile=0x39c) returned 0x1 [0049.716] WriteFile (in: hFile=0x39c, lpBuffer=0x2e2f36c*, nNumberOfBytesToWrite=0x14bf0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e2f36c*, lpNumberOfBytesWritten=0x10af310*=0x14bf0, lpOverlapped=0x0) returned 1 [0049.717] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IrJUSoID3NrK4M4p.xlsx", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IrJUSoID3NrK4M4p.xlsx", lpFilePart=0x0) returned 0x3b [0049.717] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\IrJUSoID3NrK4M4p.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\irjusoid3nrk4m4p.xlsx")) returned 1 [0049.719] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jBwwXiPpsFe.rtf", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jBwwXiPpsFe.rtf", lpFilePart=0x0) returned 0x35 [0049.719] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jBwwXiPpsFe.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\jbwwxippsfe.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.719] GetFileType (hFile=0x39c) returned 0x1 [0049.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.719] GetFileType (hFile=0x39c) returned 0x1 [0049.719] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x7639 [0049.719] ReadFile (in: hFile=0x39c, lpBuffer=0x2e44280, nNumberOfBytesToRead=0x7639, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e44280*, lpNumberOfBytesRead=0x10af320*=0x7639, lpOverlapped=0x0) returned 1 [0049.733] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jBwwXiPpsFe.rtf.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jBwwXiPpsFe.rtf.ForgiveME", lpFilePart=0x0) returned 0x3f [0049.734] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jBwwXiPpsFe.rtf.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\jbwwxippsfe.rtf.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.734] GetFileType (hFile=0x39c) returned 0x1 [0049.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.734] GetFileType (hFile=0x39c) returned 0x1 [0049.734] WriteFile (in: hFile=0x39c, lpBuffer=0x2eb61b8*, nNumberOfBytesToWrite=0x7640, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2eb61b8*, lpNumberOfBytesWritten=0x10af310*=0x7640, lpOverlapped=0x0) returned 1 [0049.735] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jBwwXiPpsFe.rtf", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jBwwXiPpsFe.rtf", lpFilePart=0x0) returned 0x35 [0049.735] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\jBwwXiPpsFe.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\jbwwxippsfe.rtf")) returned 1 [0049.737] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MyZQ-8-oWHz4CqldC.mp3", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MyZQ-8-oWHz4CqldC.mp3", lpFilePart=0x0) returned 0x3b [0049.737] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MyZQ-8-oWHz4CqldC.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\myzq-8-owhz4cqldc.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.737] GetFileType (hFile=0x39c) returned 0x1 [0049.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.737] GetFileType (hFile=0x39c) returned 0x1 [0049.737] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x15c0a [0049.737] ReadFile (in: hFile=0x39c, lpBuffer=0x3eea080, nNumberOfBytesToRead=0x15c0a, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3eea080*, lpNumberOfBytesRead=0x10af320*=0x15c0a, lpOverlapped=0x0) returned 1 [0049.757] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MyZQ-8-oWHz4CqldC.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MyZQ-8-oWHz4CqldC.mp3.ForgiveME", lpFilePart=0x0) returned 0x45 [0049.757] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MyZQ-8-oWHz4CqldC.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\myzq-8-owhz4cqldc.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.757] GetFileType (hFile=0x39c) returned 0x1 [0049.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.757] GetFileType (hFile=0x39c) returned 0x1 [0049.757] WriteFile (in: hFile=0x39c, lpBuffer=0x3f56d08*, nNumberOfBytesToWrite=0x15c10, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3f56d08*, lpNumberOfBytesWritten=0x10af310*=0x15c10, lpOverlapped=0x0) returned 1 [0049.759] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MyZQ-8-oWHz4CqldC.mp3", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MyZQ-8-oWHz4CqldC.mp3", lpFilePart=0x0) returned 0x3b [0049.759] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\MyZQ-8-oWHz4CqldC.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\myzq-8-owhz4cqldc.mp3")) returned 1 [0049.760] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\O9y_A.avi", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\O9y_A.avi", lpFilePart=0x0) returned 0x2f [0049.760] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\O9y_A.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\o9y_a.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.761] GetFileType (hFile=0x39c) returned 0x1 [0049.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.761] GetFileType (hFile=0x39c) returned 0x1 [0049.761] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xc574 [0049.761] ReadFile (in: hFile=0x39c, lpBuffer=0x2f0ad74, nNumberOfBytesToRead=0xc574, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f0ad74*, lpNumberOfBytesRead=0x10af320*=0xc574, lpOverlapped=0x0) returned 1 [0049.777] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\O9y_A.avi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\O9y_A.avi.ForgiveME", lpFilePart=0x0) returned 0x39 [0049.777] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\O9y_A.avi.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\o9y_a.avi.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.778] GetFileType (hFile=0x39c) returned 0x1 [0049.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.778] GetFileType (hFile=0x39c) returned 0x1 [0049.778] WriteFile (in: hFile=0x39c, lpBuffer=0x2f7cc94*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f7cc94*, lpNumberOfBytesWritten=0x10af310*=0xc580, lpOverlapped=0x0) returned 1 [0049.779] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\O9y_A.avi", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\O9y_A.avi", lpFilePart=0x0) returned 0x2f [0049.779] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\O9y_A.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\o9y_a.avi")) returned 1 [0049.780] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\RZqQo4EQ.mp4", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\RZqQo4EQ.mp4", lpFilePart=0x0) returned 0x32 [0049.780] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\RZqQo4EQ.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\rzqqo4eq.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.781] GetFileType (hFile=0x39c) returned 0x1 [0049.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.781] GetFileType (hFile=0x39c) returned 0x1 [0049.781] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xdecd [0049.781] ReadFile (in: hFile=0x39c, lpBuffer=0x2f894e8, nNumberOfBytesToRead=0xdecd, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f894e8*, lpNumberOfBytesRead=0x10af320*=0xdecd, lpOverlapped=0x0) returned 1 [0049.804] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\RZqQo4EQ.mp4.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\RZqQo4EQ.mp4.ForgiveME", lpFilePart=0x0) returned 0x3c [0049.804] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\RZqQo4EQ.mp4.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\rzqqo4eq.mp4.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.804] GetFileType (hFile=0x39c) returned 0x1 [0049.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.804] GetFileType (hFile=0x39c) returned 0x1 [0049.805] WriteFile (in: hFile=0x39c, lpBuffer=0x3000004*, nNumberOfBytesToWrite=0xded0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3000004*, lpNumberOfBytesWritten=0x10af310*=0xded0, lpOverlapped=0x0) returned 1 [0049.806] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\RZqQo4EQ.mp4", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\RZqQo4EQ.mp4", lpFilePart=0x0) returned 0x32 [0049.806] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\RZqQo4EQ.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\rzqqo4eq.mp4")) returned 1 [0049.808] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\r_EWMUxqWb.flv", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\r_EWMUxqWb.flv", lpFilePart=0x0) returned 0x34 [0049.808] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\r_EWMUxqWb.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\r_ewmuxqwb.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.808] GetFileType (hFile=0x39c) returned 0x1 [0049.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.808] GetFileType (hFile=0x39c) returned 0x1 [0049.808] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x3a9b [0049.808] ReadFile (in: hFile=0x39c, lpBuffer=0x300e1c8, nNumberOfBytesToRead=0x3a9b, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x300e1c8*, lpNumberOfBytesRead=0x10af320*=0x3a9b, lpOverlapped=0x0) returned 1 [0049.826] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\r_EWMUxqWb.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\r_EWMUxqWb.flv.ForgiveME", lpFilePart=0x0) returned 0x3e [0049.826] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\r_EWMUxqWb.flv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\r_ewmuxqwb.flv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.829] GetFileType (hFile=0x39c) returned 0x1 [0049.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.829] GetFileType (hFile=0x39c) returned 0x1 [0049.829] WriteFile (in: hFile=0x39c, lpBuffer=0x2e71570*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e71570*, lpNumberOfBytesWritten=0x10af310*=0x3aa0, lpOverlapped=0x0) returned 1 [0049.830] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\r_EWMUxqWb.flv", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\r_EWMUxqWb.flv", lpFilePart=0x0) returned 0x34 [0049.830] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\r_EWMUxqWb.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\r_ewmuxqwb.flv")) returned 1 [0049.834] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\tvK 9LMrcP7mW.avi", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\tvK 9LMrcP7mW.avi", lpFilePart=0x0) returned 0x37 [0049.834] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\tvK 9LMrcP7mW.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\tvk 9lmrcp7mw.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.835] GetFileType (hFile=0x39c) returned 0x1 [0049.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.835] GetFileType (hFile=0x39c) returned 0x1 [0049.835] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x5c2c [0049.835] ReadFile (in: hFile=0x39c, lpBuffer=0x2e75318, nNumberOfBytesToRead=0x5c2c, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e75318*, lpNumberOfBytesRead=0x10af320*=0x5c2c, lpOverlapped=0x0) returned 1 [0049.884] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\tvK 9LMrcP7mW.avi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\tvK 9LMrcP7mW.avi.ForgiveME", lpFilePart=0x0) returned 0x41 [0049.884] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\tvK 9LMrcP7mW.avi.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\tvk 9lmrcp7mw.avi.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.885] GetFileType (hFile=0x39c) returned 0x1 [0049.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.885] GetFileType (hFile=0x39c) returned 0x1 [0049.885] WriteFile (in: hFile=0x39c, lpBuffer=0x2edf000*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2edf000*, lpNumberOfBytesWritten=0x10af310*=0x5c30, lpOverlapped=0x0) returned 1 [0049.886] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\tvK 9LMrcP7mW.avi", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\tvK 9LMrcP7mW.avi", lpFilePart=0x0) returned 0x37 [0049.886] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\tvK 9LMrcP7mW.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\tvk 9lmrcp7mw.avi")) returned 1 [0049.891] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\U02OZDEeDuoch K8x.avi", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\U02OZDEeDuoch K8x.avi", lpFilePart=0x0) returned 0x3b [0049.891] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\U02OZDEeDuoch K8x.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\u02ozdeeduoch k8x.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.891] GetFileType (hFile=0x39c) returned 0x1 [0049.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.891] GetFileType (hFile=0x39c) returned 0x1 [0049.891] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xfddf [0049.891] ReadFile (in: hFile=0x39c, lpBuffer=0x2ee4f54, nNumberOfBytesToRead=0xfddf, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ee4f54*, lpNumberOfBytesRead=0x10af320*=0xfddf, lpOverlapped=0x0) returned 1 [0049.908] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\U02OZDEeDuoch K8x.avi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\U02OZDEeDuoch K8x.avi.ForgiveME", lpFilePart=0x0) returned 0x45 [0049.908] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\U02OZDEeDuoch K8x.avi.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\u02ozdeeduoch k8x.avi.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.909] GetFileType (hFile=0x39c) returned 0x1 [0049.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.909] GetFileType (hFile=0x39c) returned 0x1 [0049.909] WriteFile (in: hFile=0x39c, lpBuffer=0x2f617b0*, nNumberOfBytesToWrite=0xfde0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f617b0*, lpNumberOfBytesWritten=0x10af310*=0xfde0, lpOverlapped=0x0) returned 1 [0049.910] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\U02OZDEeDuoch K8x.avi", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\U02OZDEeDuoch K8x.avi", lpFilePart=0x0) returned 0x3b [0049.910] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\U02OZDEeDuoch K8x.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\u02ozdeeduoch k8x.avi")) returned 1 [0049.913] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\upLOI.jpg", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\upLOI.jpg", lpFilePart=0x0) returned 0x2f [0049.913] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\upLOI.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\uploi.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.913] GetFileType (hFile=0x39c) returned 0x1 [0049.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.913] GetFileType (hFile=0x39c) returned 0x1 [0049.913] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x3aec [0049.913] ReadFile (in: hFile=0x39c, lpBuffer=0x2f718f0, nNumberOfBytesToRead=0x3aec, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f718f0*, lpNumberOfBytesRead=0x10af320*=0x3aec, lpOverlapped=0x0) returned 1 [0049.928] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\upLOI.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\upLOI.jpg.ForgiveME", lpFilePart=0x0) returned 0x39 [0049.928] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\upLOI.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\uploi.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.928] GetFileType (hFile=0x39c) returned 0x1 [0049.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.928] GetFileType (hFile=0x39c) returned 0x1 [0049.928] WriteFile (in: hFile=0x39c, lpBuffer=0x2fd0e2c*, nNumberOfBytesToWrite=0x3af0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fd0e2c*, lpNumberOfBytesWritten=0x10af310*=0x3af0, lpOverlapped=0x0) returned 1 [0049.929] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\upLOI.jpg", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\upLOI.jpg", lpFilePart=0x0) returned 0x2f [0049.929] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\upLOI.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\uploi.jpg")) returned 1 [0049.935] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v BbMvYkEg_.mp3", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v BbMvYkEg_.mp3", lpFilePart=0x0) returned 0x35 [0049.935] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v BbMvYkEg_.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\v bbmvykeg_.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.935] GetFileType (hFile=0x39c) returned 0x1 [0049.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.935] GetFileType (hFile=0x39c) returned 0x1 [0049.935] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x16503 [0049.936] ReadFile (in: hFile=0x39c, lpBuffer=0x3fc0d98, nNumberOfBytesToRead=0x16503, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3fc0d98*, lpNumberOfBytesRead=0x10af320*=0x16503, lpOverlapped=0x0) returned 1 [0049.965] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v BbMvYkEg_.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v BbMvYkEg_.mp3.ForgiveME", lpFilePart=0x0) returned 0x3f [0049.965] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v BbMvYkEg_.mp3.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\v bbmvykeg_.mp3.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.965] GetFileType (hFile=0x39c) returned 0x1 [0049.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.965] GetFileType (hFile=0x39c) returned 0x1 [0049.965] WriteFile (in: hFile=0x39c, lpBuffer=0x4030718*, nNumberOfBytesToWrite=0x16510, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x4030718*, lpNumberOfBytesWritten=0x10af310*=0x16510, lpOverlapped=0x0) returned 1 [0049.967] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v BbMvYkEg_.mp3", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v BbMvYkEg_.mp3", lpFilePart=0x0) returned 0x35 [0049.967] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v BbMvYkEg_.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\v bbmvykeg_.mp3")) returned 1 [0049.969] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v8okskjg.mkv", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v8okskjg.mkv", lpFilePart=0x0) returned 0x32 [0049.969] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v8okskjg.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\v8okskjg.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.969] GetFileType (hFile=0x39c) returned 0x1 [0049.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.969] GetFileType (hFile=0x39c) returned 0x1 [0049.969] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xbcdf [0049.969] ReadFile (in: hFile=0x39c, lpBuffer=0x3021d9c, nNumberOfBytesToRead=0xbcdf, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3021d9c*, lpNumberOfBytesRead=0x10af320*=0xbcdf, lpOverlapped=0x0) returned 1 [0049.986] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v8okskjg.mkv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v8okskjg.mkv.ForgiveME", lpFilePart=0x0) returned 0x3c [0049.986] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v8okskjg.mkv.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\v8okskjg.mkv.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.987] GetFileType (hFile=0x39c) returned 0x1 [0049.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0049.987] GetFileType (hFile=0x39c) returned 0x1 [0049.987] WriteFile (in: hFile=0x39c, lpBuffer=0x2e9a540*, nNumberOfBytesToWrite=0xbce0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e9a540*, lpNumberOfBytesWritten=0x10af310*=0xbce0, lpOverlapped=0x0) returned 1 [0049.988] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v8okskjg.mkv", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v8okskjg.mkv", lpFilePart=0x0) returned 0x32 [0049.988] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\v8okskjg.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\v8okskjg.mkv")) returned 1 [0049.990] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vhqP-0CDpL.odp", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vhqP-0CDpL.odp", lpFilePart=0x0) returned 0x34 [0049.990] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vhqP-0CDpL.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vhqp-0cdpl.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0049.990] GetFileType (hFile=0x39c) returned 0x1 [0049.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0049.990] GetFileType (hFile=0x39c) returned 0x1 [0049.990] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x102ee [0049.990] ReadFile (in: hFile=0x39c, lpBuffer=0x2ea6514, nNumberOfBytesToRead=0x102ee, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ea6514*, lpNumberOfBytesRead=0x10af320*=0x102ee, lpOverlapped=0x0) returned 1 [0050.006] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vhqP-0CDpL.odp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vhqP-0CDpL.odp.ForgiveME", lpFilePart=0x0) returned 0x3e [0050.006] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vhqP-0CDpL.odp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vhqp-0cdpl.odp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.007] GetFileType (hFile=0x39c) returned 0x1 [0050.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0050.007] GetFileType (hFile=0x39c) returned 0x1 [0050.007] WriteFile (in: hFile=0x39c, lpBuffer=0x2f23df0*, nNumberOfBytesToWrite=0x102f0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f23df0*, lpNumberOfBytesWritten=0x10af310*=0x102f0, lpOverlapped=0x0) returned 1 [0050.008] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vhqP-0CDpL.odp", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vhqP-0CDpL.odp", lpFilePart=0x0) returned 0x34 [0050.008] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vhqP-0CDpL.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vhqp-0cdpl.odp")) returned 1 [0050.010] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\VhZFr1blgTrXMot_-KSH.avi", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\VhZFr1blgTrXMot_-KSH.avi", lpFilePart=0x0) returned 0x3e [0050.010] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\VhZFr1blgTrXMot_-KSH.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vhzfr1blgtrxmot_-ksh.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.011] GetFileType (hFile=0x39c) returned 0x1 [0050.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0050.011] GetFileType (hFile=0x39c) returned 0x1 [0050.011] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xf304 [0050.011] ReadFile (in: hFile=0x39c, lpBuffer=0x2f34408, nNumberOfBytesToRead=0xf304, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f34408*, lpNumberOfBytesRead=0x10af320*=0xf304, lpOverlapped=0x0) returned 1 [0050.034] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\VhZFr1blgTrXMot_-KSH.avi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\VhZFr1blgTrXMot_-KSH.avi.ForgiveME", lpFilePart=0x0) returned 0x48 [0050.034] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\VhZFr1blgTrXMot_-KSH.avi.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vhzfr1blgtrxmot_-ksh.avi.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.034] GetFileType (hFile=0x39c) returned 0x1 [0050.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0050.034] GetFileType (hFile=0x39c) returned 0x1 [0050.034] WriteFile (in: hFile=0x39c, lpBuffer=0x2faebf8*, nNumberOfBytesToWrite=0xf310, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2faebf8*, lpNumberOfBytesWritten=0x10af310*=0xf310, lpOverlapped=0x0) returned 1 [0050.036] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\VhZFr1blgTrXMot_-KSH.avi", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\VhZFr1blgTrXMot_-KSH.avi", lpFilePart=0x0) returned 0x3e [0050.036] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\VhZFr1blgTrXMot_-KSH.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vhzfr1blgtrxmot_-ksh.avi")) returned 1 [0050.037] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\WXDiq5.bmp", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\WXDiq5.bmp", lpFilePart=0x0) returned 0x30 [0050.038] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\WXDiq5.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\wxdiq5.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.038] GetFileType (hFile=0x39c) returned 0x1 [0050.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0050.038] GetFileType (hFile=0x39c) returned 0x1 [0050.038] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x3d1f [0050.038] ReadFile (in: hFile=0x39c, lpBuffer=0x2fbe234, nNumberOfBytesToRead=0x3d1f, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2fbe234*, lpNumberOfBytesRead=0x10af320*=0x3d1f, lpOverlapped=0x0) returned 1 [0050.052] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\WXDiq5.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\WXDiq5.bmp.ForgiveME", lpFilePart=0x0) returned 0x3a [0050.052] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\WXDiq5.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\wxdiq5.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.053] GetFileType (hFile=0x39c) returned 0x1 [0050.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0050.053] GetFileType (hFile=0x39c) returned 0x1 [0050.053] WriteFile (in: hFile=0x39c, lpBuffer=0x301e268*, nNumberOfBytesToWrite=0x3d20, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x301e268*, lpNumberOfBytesWritten=0x10af310*=0x3d20, lpOverlapped=0x0) returned 1 [0050.054] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\WXDiq5.bmp", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\WXDiq5.bmp", lpFilePart=0x0) returned 0x30 [0050.054] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\WXDiq5.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\wxdiq5.bmp")) returned 1 [0050.055] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X6uS7E.m4a", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X6uS7E.m4a", lpFilePart=0x0) returned 0x30 [0050.056] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X6uS7E.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\x6us7e.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.056] GetFileType (hFile=0x39c) returned 0x1 [0050.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0050.056] GetFileType (hFile=0x39c) returned 0x1 [0050.056] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xccb4 [0050.056] ReadFile (in: hFile=0x39c, lpBuffer=0x3022260, nNumberOfBytesToRead=0xccb4, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3022260*, lpNumberOfBytesRead=0x10af320*=0xccb4, lpOverlapped=0x0) returned 1 [0050.073] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X6uS7E.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X6uS7E.m4a.ForgiveME", lpFilePart=0x0) returned 0x3a [0050.073] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X6uS7E.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\x6us7e.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.073] GetFileType (hFile=0x39c) returned 0x1 [0050.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0050.073] GetFileType (hFile=0x39c) returned 0x1 [0050.073] WriteFile (in: hFile=0x39c, lpBuffer=0x2e966ec*, nNumberOfBytesToWrite=0xccc0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e966ec*, lpNumberOfBytesWritten=0x10af310*=0xccc0, lpOverlapped=0x0) returned 1 [0050.074] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X6uS7E.m4a", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X6uS7E.m4a", lpFilePart=0x0) returned 0x30 [0050.074] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\X6uS7E.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\x6us7e.m4a")) returned 1 [0050.076] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xQrUrmMl6.bmp", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xQrUrmMl6.bmp", lpFilePart=0x0) returned 0x33 [0050.076] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xQrUrmMl6.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xqrurmml6.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.076] GetFileType (hFile=0x39c) returned 0x1 [0050.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0050.076] GetFileType (hFile=0x39c) returned 0x1 [0050.076] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xd873 [0050.076] ReadFile (in: hFile=0x39c, lpBuffer=0x2ea368c, nNumberOfBytesToRead=0xd873, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2ea368c*, lpNumberOfBytesRead=0x10af320*=0xd873, lpOverlapped=0x0) returned 1 [0050.092] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xQrUrmMl6.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xQrUrmMl6.bmp.ForgiveME", lpFilePart=0x0) returned 0x3d [0050.092] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xQrUrmMl6.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xqrurmml6.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.093] GetFileType (hFile=0x39c) returned 0x1 [0050.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0050.093] GetFileType (hFile=0x39c) returned 0x1 [0050.093] WriteFile (in: hFile=0x39c, lpBuffer=0x2f19014*, nNumberOfBytesToWrite=0xd880, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2f19014*, lpNumberOfBytesWritten=0x10af310*=0xd880, lpOverlapped=0x0) returned 1 [0050.094] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xQrUrmMl6.bmp", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xQrUrmMl6.bmp", lpFilePart=0x0) returned 0x33 [0050.094] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xQrUrmMl6.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xqrurmml6.bmp")) returned 1 [0050.096] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xy2HcWdpce0vnT X6.jpg", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xy2HcWdpce0vnT X6.jpg", lpFilePart=0x0) returned 0x3b [0050.096] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xy2HcWdpce0vnT X6.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xy2hcwdpce0vnt x6.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.096] GetFileType (hFile=0x39c) returned 0x1 [0050.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0050.096] GetFileType (hFile=0x39c) returned 0x1 [0050.097] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x12b34 [0050.097] ReadFile (in: hFile=0x39c, lpBuffer=0x2f26ba0, nNumberOfBytesToRead=0x12b34, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2f26ba0*, lpNumberOfBytesRead=0x10af320*=0x12b34, lpOverlapped=0x0) returned 1 [0050.113] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xy2HcWdpce0vnT X6.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xy2HcWdpce0vnT X6.jpg.ForgiveME", lpFilePart=0x0) returned 0x45 [0050.113] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xy2HcWdpce0vnT X6.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xy2hcwdpce0vnt x6.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.113] GetFileType (hFile=0x39c) returned 0x1 [0050.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0050.113] GetFileType (hFile=0x39c) returned 0x1 [0050.113] WriteFile (in: hFile=0x39c, lpBuffer=0x2fabc18*, nNumberOfBytesToWrite=0x12b40, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2fabc18*, lpNumberOfBytesWritten=0x10af310*=0x12b40, lpOverlapped=0x0) returned 1 [0050.116] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xy2HcWdpce0vnT X6.jpg", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xy2HcWdpce0vnT X6.jpg", lpFilePart=0x0) returned 0x3b [0050.117] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\xy2HcWdpce0vnT X6.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\xy2hcwdpce0vnt x6.jpg")) returned 1 [0050.119] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YiN4EYoyu.bmp", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YiN4EYoyu.bmp", lpFilePart=0x0) returned 0x33 [0050.119] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YiN4EYoyu.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\yin4eyoyu.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.119] GetFileType (hFile=0x39c) returned 0x1 [0050.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0050.119] GetFileType (hFile=0x39c) returned 0x1 [0050.119] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x18306 [0050.119] ReadFile (in: hFile=0x39c, lpBuffer=0x40f7308, nNumberOfBytesToRead=0x18306, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x40f7308*, lpNumberOfBytesRead=0x10af320*=0x18306, lpOverlapped=0x0) returned 1 [0050.139] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YiN4EYoyu.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YiN4EYoyu.bmp.ForgiveME", lpFilePart=0x0) returned 0x3d [0050.139] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YiN4EYoyu.bmp.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\yin4eyoyu.bmp.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.140] GetFileType (hFile=0x39c) returned 0x1 [0050.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0050.140] GetFileType (hFile=0x39c) returned 0x1 [0050.140] WriteFile (in: hFile=0x39c, lpBuffer=0x3e5a530*, nNumberOfBytesToWrite=0x18310, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3e5a530*, lpNumberOfBytesWritten=0x10af310*=0x18310, lpOverlapped=0x0) returned 1 [0050.141] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YiN4EYoyu.bmp", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YiN4EYoyu.bmp", lpFilePart=0x0) returned 0x33 [0050.141] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\YiN4EYoyu.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\yin4eyoyu.bmp")) returned 1 [0050.143] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yLqDCyMJNAeWmoQu9D.m4a", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yLqDCyMJNAeWmoQu9D.m4a", lpFilePart=0x0) returned 0x3c [0050.143] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yLqDCyMJNAeWmoQu9D.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ylqdcymjnaewmoqu9d.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.143] GetFileType (hFile=0x39c) returned 0x1 [0050.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0050.143] GetFileType (hFile=0x39c) returned 0x1 [0050.143] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0xfbc3 [0050.144] ReadFile (in: hFile=0x39c, lpBuffer=0x2e0a0b8, nNumberOfBytesToRead=0xfbc3, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x2e0a0b8*, lpNumberOfBytesRead=0x10af320*=0xfbc3, lpOverlapped=0x0) returned 1 [0050.159] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yLqDCyMJNAeWmoQu9D.m4a.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yLqDCyMJNAeWmoQu9D.m4a.ForgiveME", lpFilePart=0x0) returned 0x46 [0050.159] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yLqDCyMJNAeWmoQu9D.m4a.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ylqdcymjnaewmoqu9d.m4a.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.160] GetFileType (hFile=0x39c) returned 0x1 [0050.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0050.160] GetFileType (hFile=0x39c) returned 0x1 [0050.160] WriteFile (in: hFile=0x39c, lpBuffer=0x2e86444*, nNumberOfBytesToWrite=0xfbd0, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x2e86444*, lpNumberOfBytesWritten=0x10af310*=0xfbd0, lpOverlapped=0x0) returned 1 [0050.161] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yLqDCyMJNAeWmoQu9D.m4a", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yLqDCyMJNAeWmoQu9D.m4a", lpFilePart=0x0) returned 0x3c [0050.161] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\yLqDCyMJNAeWmoQu9D.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ylqdcymjnaewmoqu9d.m4a")) returned 1 [0050.163] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\_fS117FO.jpg", nBufferLength=0x105, lpBuffer=0x10aed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\_fS117FO.jpg", lpFilePart=0x0) returned 0x32 [0050.163] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\_fS117FO.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\_fs117fo.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.163] GetFileType (hFile=0x39c) returned 0x1 [0050.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af268) returned 1 [0050.163] GetFileType (hFile=0x39c) returned 0x1 [0050.163] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af374 | out: lpFileSizeHigh=0x10af374*=0x0) returned 0x18181 [0050.163] ReadFile (in: hFile=0x39c, lpBuffer=0x3e92000, nNumberOfBytesToRead=0x18181, lpNumberOfBytesRead=0x10af320, lpOverlapped=0x0 | out: lpBuffer=0x3e92000*, lpNumberOfBytesRead=0x10af320*=0x18181, lpOverlapped=0x0) returned 1 [0050.180] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\_fS117FO.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\_fS117FO.jpg.ForgiveME", lpFilePart=0x0) returned 0x3c [0050.180] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\_fS117FO.jpg.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\_fs117fo.jpg.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.181] GetFileType (hFile=0x39c) returned 0x1 [0050.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af250) returned 1 [0050.181] GetFileType (hFile=0x39c) returned 0x1 [0050.181] WriteFile (in: hFile=0x39c, lpBuffer=0x3f0a800*, nNumberOfBytesToWrite=0x18190, lpNumberOfBytesWritten=0x10af310, lpOverlapped=0x0 | out: lpBuffer=0x3f0a800*, lpNumberOfBytesWritten=0x10af310*=0x18190, lpOverlapped=0x0) returned 1 [0050.190] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\_fS117FO.jpg", nBufferLength=0x105, lpBuffer=0x10aeec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\_fS117FO.jpg", lpFilePart=0x0) returned 0x32 [0050.191] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\_fS117FO.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\_fs117fo.jpg")) returned 1 [0050.195] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x2b [0050.195] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x2c [0050.195] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c788 [0050.215] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.216] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.216] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.216] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.216] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.216] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.216] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.216] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0050.216] FindClose (in: hFindFile=0x145c788 | out: hFindFile=0x145c788) returned 1 [0050.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0050.216] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x2b [0050.216] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x2c [0050.216] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c908 [0050.217] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.217] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.217] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.217] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.217] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.217] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.217] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.217] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0050.217] FindClose (in: hFindFile=0x145c908 | out: hFindFile=0x145c908) returned 1 [0050.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0050.218] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x33 [0050.218] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x34 [0050.218] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145ca88 [0050.218] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.218] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.219] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.219] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0050.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x33 [0050.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x34 [0050.219] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cdc8 [0050.219] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.219] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.219] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.219] FindClose (in: hFindFile=0x145cdc8 | out: hFindFile=0x145cdc8) returned 1 [0050.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", lpFilePart=0x0) returned 0x36 [0050.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpFilePart=0x0) returned 0x37 [0050.219] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cdc8 [0050.219] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.219] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.219] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.219] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.219] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.220] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.220] FindClose (in: hFindFile=0x145cdc8 | out: hFindFile=0x145cdc8) returned 1 [0050.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.220] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC", lpFilePart=0x0) returned 0x36 [0050.220] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\", lpFilePart=0x0) returned 0x37 [0050.220] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c708 [0050.220] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.220] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.220] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.220] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.220] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.220] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.220] FindClose (in: hFindFile=0x145c708 | out: hFindFile=0x145c708) returned 1 [0050.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.220] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab", lpFilePart=0x0) returned 0x3d [0050.220] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", lpFilePart=0x0) returned 0x3e [0050.220] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145ca88 [0050.224] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.224] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.224] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0050.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.224] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab", lpFilePart=0x0) returned 0x3d [0050.224] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\", lpFilePart=0x0) returned 0x3e [0050.224] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145c888 [0050.225] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.225] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.225] FindClose (in: hFindFile=0x145c888 | out: hFindFile=0x145c888) returned 1 [0050.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.225] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms", lpFilePart=0x0) returned 0x3c [0050.225] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", lpFilePart=0x0) returned 0x3d [0050.225] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cb88 [0050.225] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.225] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.225] FindClose (in: hFindFile=0x145cb88 | out: hFindFile=0x145cb88) returned 1 [0050.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.225] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms", lpFilePart=0x0) returned 0x3c [0050.225] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\", lpFilePart=0x0) returned 0x3d [0050.225] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cd88 [0050.225] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.225] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.225] FindClose (in: hFindFile=0x145cd88 | out: hFindFile=0x145cd88) returned 1 [0050.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.226] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", lpFilePart=0x0) returned 0x3e [0050.226] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpFilePart=0x0) returned 0x3f [0050.226] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145c788 [0050.226] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.226] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.226] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.226] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.226] FindClose (in: hFindFile=0x145c788 | out: hFindFile=0x145c788) returned 1 [0050.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.226] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", lpFilePart=0x0) returned 0x3e [0050.226] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\", lpFilePart=0x0) returned 0x3f [0050.226] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145c888 [0050.226] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.226] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.226] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.226] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.226] FindClose (in: hFindFile=0x145c888 | out: hFindFile=0x145c888) returned 1 [0050.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.227] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", lpFilePart=0x0) returned 0x3f [0050.227] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpFilePart=0x0) returned 0x40 [0050.227] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cdc8 [0050.227] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.227] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.227] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.227] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.227] FindClose (in: hFindFile=0x145cdc8 | out: hFindFile=0x145cdc8) returned 1 [0050.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.227] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", lpFilePart=0x0) returned 0x3f [0050.227] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\", lpFilePart=0x0) returned 0x40 [0050.227] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145c788 [0050.227] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.227] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.227] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.227] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.227] FindClose (in: hFindFile=0x145c788 | out: hFindFile=0x145c788) returned 1 [0050.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.228] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpFilePart=0x0) returned 0x48 [0050.228] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpFilePart=0x0) returned 0x49 [0050.228] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*", lpFindFileData=0x10aef84 | out: lpFindFileData=0x10aef84) returned 0x145c948 [0050.290] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0050.290] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0050.290] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0050.290] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 0 [0050.290] FindClose (in: hFindFile=0x145c948 | out: hFindFile=0x145c948) returned 1 [0050.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0050.290] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", lpFilePart=0x0) returned 0x48 [0050.290] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\", lpFilePart=0x0) returned 0x49 [0050.290] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*", lpFindFileData=0x10aef84 | out: lpFindFileData=0x10aef84) returned 0x145c948 [0050.291] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0050.291] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0050.291] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0050.291] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 0 [0050.291] FindClose (in: hFindFile=0x145c948 | out: hFindFile=0x145c948) returned 1 [0050.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0050.291] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x38 [0050.291] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x39 [0050.291] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145ca88 [0050.291] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.292] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.292] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.292] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.292] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0050.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.292] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x38 [0050.292] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x39 [0050.292] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cd08 [0050.292] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.292] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.292] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.292] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.292] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0050.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.292] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x43 [0050.292] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpFilePart=0x0) returned 0x44 [0050.292] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cc88 [0050.338] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.338] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.338] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.338] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0050.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.339] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x43 [0050.339] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpFilePart=0x0) returned 0x44 [0050.339] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c988 [0050.339] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.339] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.339] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.339] FindClose (in: hFindFile=0x145c988 | out: hFindFile=0x145c988) returned 1 [0050.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.339] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN", lpFilePart=0x0) returned 0x4c [0050.339] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpFilePart=0x0) returned 0x4d [0050.339] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145c808 [0050.339] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.339] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.339] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0050.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.340] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN", lpFilePart=0x0) returned 0x4c [0050.340] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\", lpFilePart=0x0) returned 0x4d [0050.340] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\NAHQNPMN\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145ca88 [0050.340] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.340] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.340] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0050.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.340] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache", lpFilePart=0x0) returned 0x44 [0050.340] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpFilePart=0x0) returned 0x45 [0050.340] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145ca88 [0050.340] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.340] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.340] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.340] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0050.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.340] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache", lpFilePart=0x0) returned 0x44 [0050.340] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\", lpFilePart=0x0) returned 0x45 [0050.340] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145ca88 [0050.341] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.341] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.341] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.341] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0050.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.341] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x36 [0050.341] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", lpFilePart=0x0) returned 0x37 [0050.341] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cc88 [0050.385] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.385] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.385] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0050.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x36 [0050.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\", lpFilePart=0x0) returned 0x37 [0050.386] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cd08 [0050.386] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.386] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.386] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0050.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x37 [0050.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x38 [0050.386] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cd08 [0050.432] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.432] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.432] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0050.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.433] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x37 [0050.433] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x38 [0050.433] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cd08 [0050.433] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.433] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.433] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0050.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.433] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x39 [0050.433] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpFilePart=0x0) returned 0x3a [0050.433] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c808 [0050.433] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.433] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.433] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.433] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.433] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0050.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.433] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x39 [0050.433] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpFilePart=0x0) returned 0x3a [0050.434] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145ca88 [0050.434] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.434] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.434] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.434] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.434] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0050.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.434] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs", lpFilePart=0x0) returned 0x3e [0050.434] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpFilePart=0x0) returned 0x3f [0050.434] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cc88 [0050.434] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.434] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.434] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0050.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.434] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs", lpFilePart=0x0) returned 0x3e [0050.434] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\", lpFilePart=0x0) returned 0x3f [0050.435] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c748 [0050.435] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.435] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.435] FindClose (in: hFindFile=0x145c748 | out: hFindFile=0x145c748) returned 1 [0050.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.435] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar", lpFilePart=0x0) returned 0x31 [0050.435] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpFilePart=0x0) returned 0x32 [0050.435] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c808 [0050.469] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.469] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.469] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.469] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0050.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.470] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar", lpFilePart=0x0) returned 0x31 [0050.470] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\", lpFilePart=0x0) returned 0x32 [0050.470] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cd88 [0050.470] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.470] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.470] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.470] FindClose (in: hFindFile=0x145cd88 | out: hFindFile=0x145cd88) returned 1 [0050.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.470] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", lpFilePart=0x0) returned 0x3a [0050.470] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpFilePart=0x0) returned 0x3b [0050.470] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c908 [0050.470] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.470] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.470] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.471] FindClose (in: hFindFile=0x145c908 | out: hFindFile=0x145c908) returned 1 [0050.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.471] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", lpFilePart=0x0) returned 0x3a [0050.471] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\", lpFilePart=0x0) returned 0x3b [0050.471] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb08 [0050.471] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.471] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.471] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.471] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0050.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.471] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml", lpFilePart=0x0) returned 0x4b [0050.471] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.475] GetFileType (hFile=0x39c) returned 0x1 [0050.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0050.475] GetFileType (hFile=0x39c) returned 0x1 [0050.475] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x4949 [0050.475] ReadFile (in: hFile=0x39c, lpBuffer=0x2efe240, nNumberOfBytesToRead=0x4949, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2efe240*, lpNumberOfBytesRead=0x10af26c*=0x4949, lpOverlapped=0x0) returned 1 [0050.490] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.ForgiveME", lpFilePart=0x0) returned 0x55 [0050.490] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.490] GetFileType (hFile=0x39c) returned 0x1 [0050.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0050.490] GetFileType (hFile=0x39c) returned 0x1 [0050.490] WriteFile (in: hFile=0x39c, lpBuffer=0x2f61f98*, nNumberOfBytesToWrite=0x4950, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2f61f98*, lpNumberOfBytesWritten=0x10af25c*=0x4950, lpOverlapped=0x0) returned 1 [0050.491] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml", lpFilePart=0x0) returned 0x4b [0050.491] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml")) returned 1 [0050.492] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x30 [0050.492] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x31 [0050.492] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c888 [0050.492] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.493] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.493] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0050.493] FindClose (in: hFindFile=0x145c888 | out: hFindFile=0x145c888) returned 1 [0050.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0050.493] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x30 [0050.493] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x31 [0050.493] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145ce48 [0050.493] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.493] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.493] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0050.493] FindClose (in: hFindFile=0x145ce48 | out: hFindFile=0x145ce48) returned 1 [0050.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0050.493] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpFilePart=0x0) returned 0x57 [0050.493] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpFilePart=0x0) returned 0x58 [0050.493] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c748 [0050.493] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.493] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.494] FindClose (in: hFindFile=0x145c748 | out: hFindFile=0x145c748) returned 1 [0050.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.494] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}", lpFilePart=0x0) returned 0x57 [0050.494] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\", lpFilePart=0x0) returned 0x58 [0050.494] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Identities\\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c888 [0050.494] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.494] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.494] FindClose (in: hFindFile=0x145c888 | out: hFindFile=0x145c888) returned 1 [0050.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.494] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x30 [0050.494] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpFilePart=0x0) returned 0x31 [0050.496] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145cb88 [0050.496] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.496] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.496] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0050.496] FindClose (in: hFindFile=0x145cb88 | out: hFindFile=0x145cb88) returned 1 [0050.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0050.496] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x30 [0050.496] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\", lpFilePart=0x0) returned 0x31 [0050.497] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145cc88 [0050.497] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.497] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.497] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0050.497] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0050.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0050.497] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x3d [0050.497] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpFilePart=0x0) returned 0x3e [0050.497] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c808 [0050.497] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.497] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.497] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.497] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.497] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0050.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.497] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x3d [0050.497] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpFilePart=0x0) returned 0x3e [0050.497] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145ce08 [0050.498] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.498] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.498] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.498] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.498] FindClose (in: hFindFile=0x145ce08 | out: hFindFile=0x145ce08) returned 1 [0050.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.498] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x4c [0050.498] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpFilePart=0x0) returned 0x4d [0050.498] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c808 [0050.498] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.498] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.498] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.498] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0050.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.499] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x4c [0050.499] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpFilePart=0x0) returned 0x4d [0050.499] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145ca88 [0050.499] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.499] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.499] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.499] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0050.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.499] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C", lpFilePart=0x0) returned 0x55 [0050.499] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpFilePart=0x0) returned 0x56 [0050.499] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cc88 [0050.499] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.499] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.499] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0050.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.500] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C", lpFilePart=0x0) returned 0x55 [0050.500] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\", lpFilePart=0x0) returned 0x56 [0050.500] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\DQQHJZ8C\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cb08 [0050.500] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.500] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.500] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0050.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.500] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x4c [0050.500] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpFilePart=0x0) returned 0x4d [0050.500] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c748 [0050.500] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.500] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.500] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.500] FindClose (in: hFindFile=0x145c748 | out: hFindFile=0x145c748) returned 1 [0050.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.500] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x4c [0050.500] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpFilePart=0x0) returned 0x4d [0050.501] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145ca88 [0050.501] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.501] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0050.501] FindNextFileW (in: hFindFile=0x145ca88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0050.501] FindClose (in: hFindFile=0x145ca88 | out: hFindFile=0x145ca88) returned 1 [0050.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0050.501] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x54 [0050.501] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpFilePart=0x0) returned 0x55 [0050.501] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cb08 [0050.501] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.501] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.501] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.501] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0050.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.501] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x54 [0050.501] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpFilePart=0x0) returned 0x55 [0050.501] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cb88 [0050.501] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.502] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0050.502] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0050.502] FindClose (in: hFindFile=0x145cb88 | out: hFindFile=0x145cb88) returned 1 [0050.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0050.502] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x60 [0050.502] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpFilePart=0x0) returned 0x61 [0050.502] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x10aef84 | out: lpFindFileData=0x10aef84) returned 0x145cc88 [0050.502] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0050.502] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0050.502] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 0 [0050.502] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0050.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0050.502] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x60 [0050.502] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpFilePart=0x0) returned 0x61 [0050.502] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x10aef84 | out: lpFindFileData=0x10aef84) returned 0x145c948 [0050.502] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0050.502] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 1 [0050.503] FindNextFileW (in: hFindFile=0x145c948, lpFindFileData=0x10aef94 | out: lpFindFileData=0x10aef94) returned 0 [0050.503] FindClose (in: hFindFile=0x145c948 | out: hFindFile=0x145c948) returned 1 [0050.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0050.503] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x10aed28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x64 [0050.503] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", nBufferLength=0x105, lpBuffer=0x10aecfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpFilePart=0x0) returned 0x65 [0050.503] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x10aef48 | out: lpFindFileData=0x10aef48) returned 0x145cdc8 [0050.503] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 1 [0050.503] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 1 [0050.503] FindNextFileW (in: hFindFile=0x145cdc8, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 0 [0050.503] FindClose (in: hFindFile=0x145cdc8 | out: hFindFile=0x145cdc8) returned 1 [0050.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1e0) returned 1 [0050.503] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x10aed28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x64 [0050.503] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", nBufferLength=0x105, lpBuffer=0x10aecfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpFilePart=0x0) returned 0x65 [0050.503] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x10aef48 | out: lpFindFileData=0x10aef48) returned 0x145c788 [0050.503] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 1 [0050.503] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c788, lpFindFileData=0x10aef58 | out: lpFindFileData=0x10aef58) returned 0 [0050.504] FindClose (in: hFindFile=0x145c788 | out: hFindFile=0x145c788) returned 1 [0050.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1e0) returned 1 [0050.504] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2f [0050.504] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x30 [0050.504] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145c808 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.504] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0050.505] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0050.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0050.505] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x10aee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2f [0050.505] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x10aee28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x30 [0050.505] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x10af074 | out: lpFindFileData=0x10af074) returned 0x145ce48 [0050.505] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.505] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 1 [0050.506] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10af084 | out: lpFindFileData=0x10af084) returned 0 [0050.506] FindClose (in: hFindFile=0x145ce48 | out: hFindFile=0x145ce48) returned 1 [0050.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0050.506] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access", lpFilePart=0x0) returned 0x36 [0050.506] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\", lpFilePart=0x0) returned 0x37 [0050.506] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c908 [0050.507] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.507] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.507] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.507] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.507] FindClose (in: hFindFile=0x145c908 | out: hFindFile=0x145c908) returned 1 [0050.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.507] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access", lpFilePart=0x0) returned 0x36 [0050.507] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\", lpFilePart=0x0) returned 0x37 [0050.507] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cb08 [0050.507] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.507] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.507] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.507] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.507] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0050.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.507] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb", lpFilePart=0x0) returned 0x48 [0050.507] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\access\\accesscache.accdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.508] GetFileType (hFile=0x39c) returned 0x1 [0050.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1f0) returned 1 [0050.508] GetFileType (hFile=0x39c) returned 0x1 [0050.508] GetFileSize (in: hFile=0x39c, lpFileSizeHigh=0x10af2fc | out: lpFileSizeHigh=0x10af2fc*=0x0) returned 0x31000 [0050.508] ReadFile (in: hFile=0x39c, lpBuffer=0x3f229b0, nNumberOfBytesToRead=0x31000, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x3f229b0*, lpNumberOfBytesRead=0x10af2a8*=0x31000, lpOverlapped=0x0) returned 1 [0050.549] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb.ForgiveME", lpFilePart=0x0) returned 0x52 [0050.549] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb.ForgiveME" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\access\\accesscache.accdb.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x39c [0050.549] GetFileType (hFile=0x39c) returned 0x1 [0050.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1d8) returned 1 [0050.549] GetFileType (hFile=0x39c) returned 0x1 [0050.549] WriteFile (in: hFile=0x39c, lpBuffer=0x4017a30*, nNumberOfBytesToWrite=0x31010, lpNumberOfBytesWritten=0x10af298, lpOverlapped=0x0 | out: lpBuffer=0x4017a30*, lpNumberOfBytesWritten=0x10af298*=0x31010, lpOverlapped=0x0) returned 1 [0050.552] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb", nBufferLength=0x105, lpBuffer=0x10aee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb", lpFilePart=0x0) returned 0x48 [0050.552] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\access\\accesscache.accdb")) returned 1 [0050.553] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x36 [0050.554] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x37 [0050.554] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c808 [0050.557] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.557] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.557] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0050.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.557] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x36 [0050.557] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x37 [0050.557] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cb88 [0050.558] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.558] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0050.558] FindClose (in: hFindFile=0x145cb88 | out: hFindFile=0x145cb88) returned 1 [0050.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0050.558] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography", lpFilePart=0x0) returned 0x3c [0050.558] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpFilePart=0x0) returned 0x3d [0050.558] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Bibliography\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c808 [0050.558] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0050.634] ReadFile (in: hFile=0x39c, lpBuffer=0x410f630, nNumberOfBytesToRead=0x388cc7, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x410f630*, lpNumberOfBytesRead=0x10af230*=0x388cc7, lpOverlapped=0x0) returned 1 [0051.366] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.ForgiveME", lpFilePart=0x0) returned 0x78 [0051.803] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Calendar insights.xltm.ForgiveME", lpFilePart=0x0) returned 0x5a [0051.904] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.ForgiveME", lpFilePart=0x0) returned 0x5a [0051.919] ReadFile (in: hFile=0x3b0, lpBuffer=0xbf5dc28, nNumberOfBytesToRead=0xb431d, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0xbf5dc28*, lpNumberOfBytesRead=0x10af2a8*=0xb431d, lpOverlapped=0x0) returned 1 [0052.409] ReadFile (in: hFile=0x3b0, lpBuffer=0x3eadc10, nNumberOfBytesToRead=0x1ad7d, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x3eadc10*, lpNumberOfBytesRead=0x10af2a8*=0x1ad7d, lpOverlapped=0x0) returned 1 [0052.441] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Basic Flowchart.xltx.ForgiveME", lpFilePart=0x0) returned 0x68 [0052.445] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f4ed70, nNumberOfBytesToRead=0x2355e, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x3f4ed70*, lpNumberOfBytesRead=0x10af2a8*=0x2355e, lpOverlapped=0x0) returned 1 [0052.527] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Templates\\Process Map for Cross-Functional Flowchart.xltx.ForgiveME", lpFilePart=0x0) returned 0x73 [0052.533] ReadFile (in: hFile=0x3b0, lpBuffer=0x4022e10, nNumberOfBytesToRead=0x16438a, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x4022e10*, lpNumberOfBytesRead=0x10af2a8*=0x16438a, lpOverlapped=0x0) returned 1 [0053.468] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist-plugins.json.ForgiveME", lpFilePart=0x0) returned 0x70 [0053.476] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f20a00, nNumberOfBytesToRead=0x3ef9f, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x3f20a00*, lpNumberOfBytesRead=0x10af230*=0x3ef9f, lpOverlapped=0x0) returned 1 [0053.532] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\blocklist.xml.ForgiveME", lpFilePart=0x0) returned 0x67 [0053.536] ReadFile (in: hFile=0x3b0, lpBuffer=0x409a820, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x409a820*, lpNumberOfBytesRead=0x10af230*=0x18000, lpOverlapped=0x0) returned 1 [0054.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.ForgiveME", lpFilePart=0x0) returned 0x54 [0054.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0054.264] ReadFile (in: hFile=0x3b0, lpBuffer=0x4140310, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0x4140310*, lpNumberOfBytesRead=0x10af2a8*=0x300000, lpOverlapped=0x0) returned 1 [0054.579] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.log.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.log.ForgiveME", lpFilePart=0x0) returned 0x46 [0054.635] ReadFile (in: hFile=0x3b0, lpBuffer=0xb571048, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0x10af2a8, lpOverlapped=0x0 | out: lpBuffer=0xb571048*, lpNumberOfBytesRead=0x10af2a8*=0x300000, lpOverlapped=0x0) returned 1 [0055.347] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.ForgiveME", lpFilePart=0x0) returned 0x60 [0064.490] ReadFile (in: hFile=0x3b0, lpBuffer=0x3efcac8, nNumberOfBytesToRead=0x32a2e, lpNumberOfBytesRead=0x10af17c, lpOverlapped=0x0 | out: lpBuffer=0x3efcac8*, lpNumberOfBytesRead=0x10af17c*=0x32a2e, lpOverlapped=0x0) returned 1 [0064.532] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aebbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.ForgiveME", lpFilePart=0x0) returned 0x96 [0064.823] ReadFile (in: hFile=0x3b0, lpBuffer=0x402c848, nNumberOfBytesToRead=0x3b059, lpNumberOfBytesRead=0x10af17c, lpOverlapped=0x0 | out: lpBuffer=0x402c848*, lpNumberOfBytesRead=0x10af17c*=0x3b059, lpOverlapped=0x0) returned 1 [0072.834] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.ForgiveME", lpFilePart=0x0) returned 0x9f [0076.620] ReadFile (in: hFile=0x3b0, lpBuffer=0x41bec58, nNumberOfBytesToRead=0x28df6, lpNumberOfBytesRead=0x10af1b8, lpOverlapped=0x0 | out: lpBuffer=0x41bec58*, lpNumberOfBytesRead=0x10af1b8*=0x28df6, lpOverlapped=0x0) returned 1 [0076.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0076.931] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x10aedc8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x5b [0076.932] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x10aedc8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x5b [0076.933] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x10aeda8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x5c [0076.933] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x10aed9c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x5c [0076.934] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x10aed9c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x5c [0076.936] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x10aedc8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x5b [0076.936] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x10aedc8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x5b [0076.937] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x10aeda8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x5c [0076.937] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x10aed9c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x5c [0076.938] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x10aed9c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x5c [0083.184] ReadFile (in: hFile=0x3b0, lpBuffer=0x41ba8d0, nNumberOfBytesToRead=0x7170c, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x41ba8d0*, lpNumberOfBytesRead=0x10af230*=0x7170c, lpOverlapped=0x0) returned 1 [0084.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10adf10) returned 1 [0084.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0084.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0084.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0084.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0084.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0084.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0084.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0084.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0084.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0084.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0084.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0084.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0084.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0084.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0084.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af318) returned 1 [0084.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0084.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0084.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af318) returned 1 [0084.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0084.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0084.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0084.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0084.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0084.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0084.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0084.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0084.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0084.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0084.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0084.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0088.649] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ecc2c8, nNumberOfBytesToRead=0x26874, lpNumberOfBytesRead=0x10af0c8, lpOverlapped=0x0 | out: lpBuffer=0x3ecc2c8*, lpNumberOfBytesRead=0x10af0c8*=0x26874, lpOverlapped=0x0) returned 1 [0088.691] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aeb08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js.ForgiveME", lpFilePart=0x0) returned 0xa3 [0089.140] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ffe438, nNumberOfBytesToRead=0x49408, lpNumberOfBytesRead=0x10af1f4, lpOverlapped=0x0 | out: lpBuffer=0x3ffe438*, lpNumberOfBytesRead=0x10af1f4*=0x49408, lpOverlapped=0x0) returned 1 [0089.311] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aea90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log.ForgiveME", lpFilePart=0x0) returned 0xb6 [0089.448] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbtmp.log.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aea90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbtmp.log.ForgiveME", lpFilePart=0x0) returned 0xb9 [0089.633] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aebf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log.ForgiveME", lpFilePart=0x0) returned 0x84 [0089.696] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbtmp.log.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aebf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbtmp.log.ForgiveME", lpFilePart=0x0) returned 0x87 [0091.051] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ed99a0, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x3ed99a0*, lpNumberOfBytesRead=0x10af230*=0x40000, lpOverlapped=0x0) returned 1 [0091.103] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.ForgiveME", lpFilePart=0x0) returned 0xbd [0093.037] ReadFile (in: hFile=0x3b0, lpBuffer=0x4079a70, nNumberOfBytesToRead=0x1d5d0, lpNumberOfBytesRead=0x10af1b8, lpOverlapped=0x0 | out: lpBuffer=0x4079a70*, lpNumberOfBytesRead=0x10af1b8*=0x1d5d0, lpOverlapped=0x0) returned 1 [0093.426] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\20\\8636b4dd[1].js.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aebf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\20\\8636b4dd[1].js.ForgiveME", lpFilePart=0x0) returned 0x85 [0093.484] ReadFile (in: hFile=0x3b0, lpBuffer=0x3eb3200, nNumberOfBytesToRead=0x1ac70, lpNumberOfBytesRead=0x10af1b8, lpOverlapped=0x0 | out: lpBuffer=0x3eb3200*, lpNumberOfBytesRead=0x10af1b8*=0x1ac70, lpOverlapped=0x0) returned 1 [0093.504] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\20\\9d6b7893[1].js.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aebf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\20\\9d6b7893[1].js.ForgiveME", lpFilePart=0x0) returned 0x85 [0093.561] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f6dd10, nNumberOfBytesToRead=0x1e9ac, lpNumberOfBytesRead=0x10af1b8, lpOverlapped=0x0 | out: lpBuffer=0x3f6dd10*, lpNumberOfBytesRead=0x10af1b8*=0x1e9ac, lpOverlapped=0x0) returned 1 [0093.581] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\20\\e1e405d1[1].js.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aebf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\20\\e1e405d1[1].js.ForgiveME", lpFilePart=0x0) returned 0x85 [0093.602] ReadFile (in: hFile=0x3b0, lpBuffer=0x4025788, nNumberOfBytesToRead=0x2102f, lpNumberOfBytesRead=0x10af1b8, lpOverlapped=0x0 | out: lpBuffer=0x4025788*, lpNumberOfBytesRead=0x10af1b8*=0x2102f, lpOverlapped=0x0) returned 1 [0093.622] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\20\\ead33c13[1].js.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aebf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\20\\ead33c13[1].js.ForgiveME", lpFilePart=0x0) returned 0x85 [0093.627] ReadFile (in: hFile=0x3b0, lpBuffer=0x40eb908, nNumberOfBytesToRead=0x26851, lpNumberOfBytesRead=0x10af1b8, lpOverlapped=0x0 | out: lpBuffer=0x40eb908*, lpNumberOfBytesRead=0x10af1b8*=0x26851, lpOverlapped=0x0) returned 1 [0093.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af220) returned 1 [0094.123] ReadFile (in: hFile=0x3b0, lpBuffer=0x4192198, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x4192198*, lpNumberOfBytesRead=0x10af230*=0x80000, lpOverlapped=0x0) returned 1 [0094.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0094.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0094.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0094.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0096.945] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.ForgiveME", lpFilePart=0x0) returned 0xb4 [0098.019] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f750c0, nNumberOfBytesToRead=0x14df3, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x3f750c0*, lpNumberOfBytesRead=0x10af2e4*=0x14df3, lpOverlapped=0x0) returned 1 [0098.039] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\7MVr6A9.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\7MVr6A9.jpg.ForgiveME", lpFilePart=0x0) returned 0x3e [0098.260] ReadFile (in: hFile=0x3b0, lpBuffer=0x4054190, nNumberOfBytesToRead=0x18f04, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x4054190*, lpNumberOfBytesRead=0x10af2e4*=0x18f04, lpOverlapped=0x0) returned 1 [0098.281] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\j6oTqqYA70Xk3K.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\j6oTqqYA70Xk3K.jpg.ForgiveME", lpFilePart=0x0) returned 0x45 [0098.343] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\MNFTwGM.mp3.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\MNFTwGM.mp3.ForgiveME", lpFilePart=0x0) returned 0x3e [0098.419] ReadFile (in: hFile=0x3b0, lpBuffer=0x3eb4400, nNumberOfBytesToRead=0x1786c, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x3eb4400*, lpNumberOfBytesRead=0x10af2e4*=0x1786c, lpOverlapped=0x0) returned 1 [0098.437] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\sdfyZV.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\sdfyZV.jpg.ForgiveME", lpFilePart=0x0) returned 0x3d [0098.440] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f416f8, nNumberOfBytesToRead=0x15ee6, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x3f416f8*, lpNumberOfBytesRead=0x10af2e4*=0x15ee6, lpOverlapped=0x0) returned 1 [0098.460] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\T-WnZD5GrbCl.gif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\T-WnZD5GrbCl.gif.ForgiveME", lpFilePart=0x0) returned 0x43 [0098.485] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fec950, nNumberOfBytesToRead=0x16d1a, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x3fec950*, lpNumberOfBytesRead=0x10af2e4*=0x16d1a, lpOverlapped=0x0) returned 1 [0098.504] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\UAml.mp4.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\UAml.mp4.ForgiveME", lpFilePart=0x0) returned 0x3b [0098.507] ReadFile (in: hFile=0x3b0, lpBuffer=0x4075868, nNumberOfBytesToRead=0x1708a, lpNumberOfBytesRead=0x10af2e4, lpOverlapped=0x0 | out: lpBuffer=0x4075868*, lpNumberOfBytesRead=0x10af2e4*=0x1708a, lpOverlapped=0x0) returned 1 [0098.526] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\VKhbY9DLxE293q6.flv.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aed24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\VKhbY9DLxE293q6.flv.ForgiveME", lpFilePart=0x0) returned 0x46 [0098.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0098.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0101.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af388) returned 1 [0101.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0101.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0101.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0101.285] ReadFile (in: hFile=0x3b0, lpBuffer=0x3e498d0, nNumberOfBytesToRead=0xd77c4, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x3e498d0*, lpNumberOfBytesRead=0x10af230*=0xd77c4, lpOverlapped=0x0) returned 1 [0101.809] ReadFile (in: hFile=0x3b0, lpBuffer=0x427f010, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x427f010*, lpNumberOfBytesRead=0x10af230*=0x38480a, lpOverlapped=0x0) returned 1 [0102.185] FindClose (in: hFindFile=0x145c9c8 | out: hFindFile=0x145c9c8) returned 1 [0102.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0102.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0102.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0102.185] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05", lpFilePart=0x0) returned 0x48 [0102.186] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0102.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0102.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0102.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0102.186] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16", lpFilePart=0x0) returned 0x51 [0102.186] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\", lpFilePart=0x0) returned 0x52 [0102.286] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0102.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0102.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0102.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0102.286] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16", lpFilePart=0x0) returned 0x51 [0102.286] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\", lpFilePart=0x0) returned 0x52 [0102.287] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0102.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0102.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0102.578] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat.ForgiveME", lpFilePart=0x0) returned 0x74 [0102.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af164) returned 1 [0102.578] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\en-us.16\\stream.x64.en-us.man.dat.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0102.582] GetFileType (hFile=0x3b0) returned 0x1 [0102.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af160) returned 1 [0102.582] GetFileType (hFile=0x3b0) returned 0x1 [0102.582] WriteFile (in: hFile=0x3b0, lpBuffer=0xbe007b8*, nNumberOfBytesToWrite=0xd77d0, lpNumberOfBytesWritten=0x10af220, lpOverlapped=0x0 | out: lpBuffer=0xbe007b8*, lpNumberOfBytesWritten=0x10af220*=0xd77d0, lpOverlapped=0x0) returned 1 [0102.592] CloseHandle (hObject=0x3b0) returned 1 [0102.607] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x10aedd0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x6a [0102.607] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\en-us.16\\stream.x64.en-us.man.dat")) returned 1 [0102.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0102.612] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16", lpFilePart=0x0) returned 0x52 [0102.612] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\", lpFilePart=0x0) returned 0x53 [0102.629] FindClose (in: hFindFile=0x145ce88 | out: hFindFile=0x145ce88) returned 1 [0102.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0102.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0102.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0102.799] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16", lpFilePart=0x0) returned 0x52 [0102.799] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\", lpFilePart=0x0) returned 0x53 [0102.800] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0102.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0102.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0102.825] ReadFile (in: hFile=0x3b0, lpBuffer=0xbed7fa8, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0xbed7fa8*, lpNumberOfBytesRead=0x10af230*=0x38480a, lpOverlapped=0x0) returned 1 [0102.965] CloseHandle (hObject=0x3b0) returned 1 [0103.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat.ForgiveME", lpFilePart=0x0) returned 0x76 [0103.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af164) returned 1 [0103.261] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\x-none.16\\stream.x64.x-none.man.dat.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0103.262] GetFileType (hFile=0x3b0) returned 0x1 [0103.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af160) returned 1 [0103.262] GetFileType (hFile=0x3b0) returned 0x1 [0103.262] WriteFile (in: hFile=0x3b0, lpBuffer=0x45028f0*, nNumberOfBytesToWrite=0x384810, lpNumberOfBytesWritten=0x10af220, lpOverlapped=0x0 | out: lpBuffer=0x45028f0*, lpNumberOfBytesWritten=0x10af220*=0x384810, lpOverlapped=0x0) returned 1 [0103.305] CloseHandle (hObject=0x3b0) returned 1 [0103.393] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x10aedd0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x6c [0103.393] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\x-none.16\\stream.x64.x-none.man.dat")) returned 1 [0103.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0103.397] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData", lpFilePart=0x0) returned 0x2f [0103.397] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\", lpFilePart=0x0) returned 0x30 [0103.398] FindClose (in: hFindFile=0x145c848 | out: hFindFile=0x145c848) returned 1 [0103.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0103.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0103.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0103.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData", lpFilePart=0x0) returned 0x2f [0103.399] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\", lpFilePart=0x0) returned 0x30 [0103.399] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0103.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0103.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0103.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0103.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpFilePart=0x0) returned 0x37 [0103.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\", lpFilePart=0x0) returned 0x38 [0103.400] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0103.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0103.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0103.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0103.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpFilePart=0x0) returned 0x37 [0103.400] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\", lpFilePart=0x0) returned 0x38 [0103.401] FindClose (in: hFindFile=0x145cc08 | out: hFindFile=0x145cc08) returned 1 [0103.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0103.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0103.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af25c) returned 1 [0103.401] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", lpFilePart=0x0) returned 0x40 [0103.401] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\", lpFilePart=0x0) returned 0x41 [0103.401] FindClose (in: hFindFile=0x145c848 | out: hFindFile=0x145c848) returned 1 [0103.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0103.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af228) returned 1 [0103.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af25c) returned 1 [0103.402] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", lpFilePart=0x0) returned 0x40 [0103.402] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\", lpFilePart=0x0) returned 0x41 [0103.402] FindClose (in: hFindFile=0x145ce88 | out: hFindFile=0x145ce88) returned 1 [0103.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0103.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af228) returned 1 [0103.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af220) returned 1 [0103.402] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}", nBufferLength=0x105, lpBuffer=0x10aed28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpFilePart=0x0) returned 0x67 [0103.402] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\", nBufferLength=0x105, lpBuffer=0x10aecfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\", lpFilePart=0x0) returned 0x68 [0103.403] FindClose (in: hFindFile=0x145ce88 | out: hFindFile=0x145ce88) returned 1 [0103.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1e0) returned 1 [0103.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1ec) returned 1 [0103.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af220) returned 1 [0103.403] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}", nBufferLength=0x105, lpBuffer=0x10aed28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpFilePart=0x0) returned 0x67 [0103.403] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\", nBufferLength=0x105, lpBuffer=0x10aecfc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\", lpFilePart=0x0) returned 0x68 [0103.403] FindClose (in: hFindFile=0x145cc08 | out: hFindFile=0x145cc08) returned 1 [0103.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1e0) returned 1 [0103.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1ec) returned 1 [0103.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1e4) returned 1 [0103.404] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", nBufferLength=0x105, lpBuffer=0x10aecec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpFilePart=0x0) returned 0x8e [0103.404] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\", nBufferLength=0x105, lpBuffer=0x10aecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\", lpFilePart=0x0) returned 0x8f [0103.404] FindClose (in: hFindFile=0x145c708 | out: hFindFile=0x145c708) returned 1 [0103.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1a4) returned 1 [0103.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b0) returned 1 [0103.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1e4) returned 1 [0103.404] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", nBufferLength=0x105, lpBuffer=0x10aecec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpFilePart=0x0) returned 0x8e [0103.404] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\", nBufferLength=0x105, lpBuffer=0x10aecc0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\", lpFilePart=0x0) returned 0x8f [0103.405] FindClose (in: hFindFile=0x145c708 | out: hFindFile=0x145c708) returned 1 [0103.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1a4) returned 1 [0103.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b0) returned 1 [0104.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aebbc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.ForgiveME", lpFilePart=0x0) returned 0xa5 [0104.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af0b0) returned 1 [0104.033] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0104.034] GetFileType (hFile=0x3b0) returned 0x1 [0104.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af0ac) returned 1 [0104.034] GetFileType (hFile=0x3b0) returned 0x1 [0104.034] WriteFile (in: hFile=0x3b0, lpBuffer=0xba371a8*, nNumberOfBytesToWrite=0x5c6180, lpNumberOfBytesWritten=0x10af16c, lpOverlapped=0x0 | out: lpBuffer=0xba371a8*, lpNumberOfBytesWritten=0x10af16c*=0x5c6180, lpOverlapped=0x0) returned 1 [0104.101] CloseHandle (hObject=0x3b0) returned 1 [0104.200] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", nBufferLength=0x105, lpBuffer=0x10aed1c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", lpFilePart=0x0) returned 0x9b [0104.200] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml")) returned 1 [0104.222] ReadFile (in: hFile=0x3b0, lpBuffer=0x4985bf0, nNumberOfBytesToRead=0x39cc27, lpNumberOfBytesRead=0x10af17c, lpOverlapped=0x0 | out: lpBuffer=0x4985bf0*, lpNumberOfBytesRead=0x10af17c*=0x39cc27, lpOverlapped=0x0) returned 1 [0104.333] CloseHandle (hObject=0x3b0) returned 1 [0105.013] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0105.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0105.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0105.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0105.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration", lpFilePart=0x0) returned 0x3b [0105.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\", lpFilePart=0x0) returned 0x3c [0105.014] FindClose (in: hFindFile=0x145cdc8 | out: hFindFile=0x145cdc8) returned 1 [0105.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0105.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0105.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af25c) returned 1 [0105.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", lpFilePart=0x0) returned 0x4b [0105.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\", lpFilePart=0x0) returned 0x4c [0105.015] FindClose (in: hFindFile=0x145cd48 | out: hFindFile=0x145cd48) returned 1 [0105.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0105.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af228) returned 1 [0105.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af25c) returned 1 [0105.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", lpFilePart=0x0) returned 0x4b [0105.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\", lpFilePart=0x0) returned 0x4c [0105.016] FindClose (in: hFindFile=0x145cc08 | out: hFindFile=0x145cc08) returned 1 [0105.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0105.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af228) returned 1 [0105.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0105.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases", lpFilePart=0x0) returned 0x33 [0105.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\", lpFilePart=0x0) returned 0x34 [0105.025] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0105.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0105.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0105.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0105.026] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases", lpFilePart=0x0) returned 0x33 [0105.026] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\", lpFilePart=0x0) returned 0x34 [0105.027] FindClose (in: hFindFile=0x145c748 | out: hFindFile=0x145c748) returned 1 [0105.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0105.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0105.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0105.027] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60", lpFilePart=0x0) returned 0x58 [0105.027] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\", lpFilePart=0x0) returned 0x59 [0105.029] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0105.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0105.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0105.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0105.029] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60", lpFilePart=0x0) returned 0x58 [0105.029] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\", lpFilePart=0x0) returned 0x59 [0105.029] FindClose (in: hFindFile=0x145c848 | out: hFindFile=0x145c848) returned 1 [0105.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0105.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0105.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af25c) returned 1 [0105.029] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16", lpFilePart=0x0) returned 0x61 [0105.029] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\", lpFilePart=0x0) returned 0x62 [0105.042] FindClose (in: hFindFile=0x145c8c8 | out: hFindFile=0x145c8c8) returned 1 [0105.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0105.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af228) returned 1 [0105.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af25c) returned 1 [0105.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16", lpFilePart=0x0) returned 0x61 [0105.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\", lpFilePart=0x0) returned 0x62 [0105.044] FindClose (in: hFindFile=0x145cc08 | out: hFindFile=0x145cc08) returned 1 [0105.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0105.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af228) returned 1 [0105.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\stream.Platform.Culture.man.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec34, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\stream.Platform.Culture.man.xml.ForgiveME", lpFilePart=0x0) returned 0x8b [0105.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af128) returned 1 [0105.465] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\stream.Platform.Culture.man.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\eda58a0b-ad79-496a-8530-618d08767e60\\en-us.16\\stream.platform.culture.man.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0105.466] GetFileType (hFile=0x3b0) returned 0x1 [0105.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af124) returned 1 [0105.466] GetFileType (hFile=0x3b0) returned 0x1 [0105.466] WriteFile (in: hFile=0x3b0, lpBuffer=0x47f8330*, nNumberOfBytesToWrite=0x1ffba0, lpNumberOfBytesWritten=0x10af1e4, lpOverlapped=0x0 | out: lpBuffer=0x47f8330*, lpNumberOfBytesWritten=0x10af1e4*=0x1ffba0, lpOverlapped=0x0) returned 1 [0105.488] CloseHandle (hObject=0x3b0) returned 1 [0105.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\stream.Platform.Culture.man.xml", nBufferLength=0x105, lpBuffer=0x10aed94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\stream.Platform.Culture.man.xml", lpFilePart=0x0) returned 0x81 [0105.515] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\eda58a0b-ad79-496a-8530-618d08767e60\\en-us.16\\stream.platform.culture.man.xml")) returned 1 [0105.523] ReadFile (in: hFile=0x3b0, lpBuffer=0x49f7ef0, nNumberOfBytesToRead=0x11277a, lpNumberOfBytesRead=0x10af1f4, lpOverlapped=0x0 | out: lpBuffer=0x49f7ef0*, lpNumberOfBytesRead=0x10af1f4*=0x11277a, lpOverlapped=0x0) returned 1 [0105.565] CloseHandle (hObject=0x3b0) returned 1 [0105.620] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\stream.x64.en-us.man.dat.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec34, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\stream.x64.en-us.man.dat.ForgiveME", lpFilePart=0x0) returned 0x84 [0105.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af128) returned 1 [0105.620] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\stream.x64.en-us.man.dat.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\eda58a0b-ad79-496a-8530-618d08767e60\\en-us.16\\stream.x64.en-us.man.dat.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0105.621] GetFileType (hFile=0x3b0) returned 0x1 [0105.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af124) returned 1 [0105.621] GetFileType (hFile=0x3b0) returned 0x1 [0105.621] WriteFile (in: hFile=0x3b0, lpBuffer=0xb695f18*, nNumberOfBytesToWrite=0x112780, lpNumberOfBytesWritten=0x10af1e4, lpOverlapped=0x0 | out: lpBuffer=0xb695f18*, lpNumberOfBytesWritten=0x10af1e4*=0x112780, lpOverlapped=0x0) returned 1 [0105.634] CloseHandle (hObject=0x3b0) returned 1 [0105.674] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x10aed94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x7a [0105.674] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\eda58a0b-ad79-496a-8530-618d08767e60\\en-us.16\\stream.x64.en-us.man.dat")) returned 1 [0105.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af25c) returned 1 [0105.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16", lpFilePart=0x0) returned 0x62 [0105.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\", lpFilePart=0x0) returned 0x63 [0105.679] FindClose (in: hFindFile=0x145c8c8 | out: hFindFile=0x145c8c8) returned 1 [0105.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0105.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af228) returned 1 [0105.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af25c) returned 1 [0105.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16", lpFilePart=0x0) returned 0x62 [0105.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\", lpFilePart=0x0) returned 0x63 [0105.681] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0105.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0105.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af228) returned 1 [0107.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\stream.Platform.x-none.man.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec34, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\stream.Platform.x-none.man.xml.ForgiveME", lpFilePart=0x0) returned 0x8b [0107.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af128) returned 1 [0107.085] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\stream.Platform.x-none.man.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\eda58a0b-ad79-496a-8530-618d08767e60\\x-none.16\\stream.platform.x-none.man.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0107.085] GetFileType (hFile=0x3b0) returned 0x1 [0107.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af124) returned 1 [0107.085] GetFileType (hFile=0x3b0) returned 0x1 [0107.085] WriteFile (in: hFile=0x3b0, lpBuffer=0xfa51018*, nNumberOfBytesToWrite=0xb696d0, lpNumberOfBytesWritten=0x10af1e4, lpOverlapped=0x0 | out: lpBuffer=0xfa51018*, lpNumberOfBytesWritten=0x10af1e4*=0xb696d0, lpOverlapped=0x0) returned 1 [0107.234] CloseHandle (hObject=0x3b0) returned 1 [0107.631] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\stream.Platform.x-none.man.xml", nBufferLength=0x105, lpBuffer=0x10aed94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\stream.Platform.x-none.man.xml", lpFilePart=0x0) returned 0x81 [0107.631] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\eda58a0b-ad79-496a-8530-618d08767e60\\x-none.16\\stream.platform.x-none.man.xml")) returned 1 [0107.640] ReadFile (in: hFile=0x3b0, lpBuffer=0xf123db8, nNumberOfBytesToRead=0x5d3a94, lpNumberOfBytesRead=0x10af1f4, lpOverlapped=0x0 | out: lpBuffer=0xf123db8*, lpNumberOfBytesRead=0x10af1f4*=0x5d3a94, lpOverlapped=0x0) returned 1 [0107.881] CloseHandle (hObject=0x3b0) returned 1 [0108.356] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\stream.x64.x-none.man.dat.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec34, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\stream.x64.x-none.man.dat.ForgiveME", lpFilePart=0x0) returned 0x86 [0108.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af128) returned 1 [0108.357] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\stream.x64.x-none.man.dat.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\eda58a0b-ad79-496a-8530-618d08767e60\\x-none.16\\stream.x64.x-none.man.dat.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0108.357] GetFileType (hFile=0x3b0) returned 0x1 [0108.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af124) returned 1 [0108.357] GetFileType (hFile=0x3b0) returned 0x1 [0108.357] WriteFile (in: hFile=0x3b0, lpBuffer=0x12a51018*, nNumberOfBytesToWrite=0x5d3aa0, lpNumberOfBytesWritten=0x10af1e4, lpOverlapped=0x0 | out: lpBuffer=0x12a51018*, lpNumberOfBytesWritten=0x10af1e4*=0x5d3aa0, lpOverlapped=0x0) returned 1 [0108.608] CloseHandle (hObject=0x3b0) returned 1 [0108.745] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x10aed94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x7c [0108.746] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\EDA58A0B-AD79-496A-8530-618D08767E60\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\eda58a0b-ad79-496a-8530-618d08767e60\\x-none.16\\stream.x64.x-none.man.dat")) returned 1 [0108.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0108.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E", lpFilePart=0x0) returned 0x58 [0108.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\", lpFilePart=0x0) returned 0x59 [0108.753] FindClose (in: hFindFile=0x145cd88 | out: hFindFile=0x145cd88) returned 1 [0108.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0108.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0108.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0108.753] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E", lpFilePart=0x0) returned 0x58 [0108.754] FindClose (in: hFindFile=0x145cb48 | out: hFindFile=0x145cb48) returned 1 [0108.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0108.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0108.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af25c) returned 1 [0108.754] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16", lpFilePart=0x0) returned 0x61 [0108.754] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\", lpFilePart=0x0) returned 0x62 [0108.757] FindClose (in: hFindFile=0x145cd48 | out: hFindFile=0x145cd48) returned 1 [0108.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0108.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af228) returned 1 [0108.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af25c) returned 1 [0108.758] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16", lpFilePart=0x0) returned 0x61 [0108.758] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\", lpFilePart=0x0) returned 0x62 [0108.759] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0108.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0108.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af228) returned 1 [0108.786] ReadFile (in: hFile=0x3b0, lpBuffer=0x4962fb0, nNumberOfBytesToRead=0x1b9abc, lpNumberOfBytesRead=0x10af1f4, lpOverlapped=0x0 | out: lpBuffer=0x4962fb0*, lpNumberOfBytesRead=0x10af1f4*=0x1b9abc, lpOverlapped=0x0) returned 1 [0108.858] CloseHandle (hObject=0x3b0) returned 1 [0108.988] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\Stream.Platform.Culture.man.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec34, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\Stream.Platform.Culture.man.xml.ForgiveME", lpFilePart=0x0) returned 0x8b [0108.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af128) returned 1 [0108.988] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\Stream.Platform.Culture.man.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\f227e87a-b6b1-42dd-93d7-cc66c1f69c7e\\en-us.16\\stream.platform.culture.man.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0108.989] GetFileType (hFile=0x3b0) returned 0x1 [0108.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af124) returned 1 [0108.989] GetFileType (hFile=0x3b0) returned 0x1 [0108.989] WriteFile (in: hFile=0x3b0, lpBuffer=0xd1941c8*, nNumberOfBytesToWrite=0x1b9ac0, lpNumberOfBytesWritten=0x10af1e4, lpOverlapped=0x0 | out: lpBuffer=0xd1941c8*, lpNumberOfBytesWritten=0x10af1e4*=0x1b9ac0, lpOverlapped=0x0) returned 1 [0109.015] CloseHandle (hObject=0x3b0) returned 1 [0109.041] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\Stream.Platform.Culture.man.xml", nBufferLength=0x105, lpBuffer=0x10aed94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\Stream.Platform.Culture.man.xml", lpFilePart=0x0) returned 0x81 [0109.041] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\Stream.Platform.Culture.man.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\f227e87a-b6b1-42dd-93d7-cc66c1f69c7e\\en-us.16\\stream.platform.culture.man.xml")) returned 1 [0109.053] ReadFile (in: hFile=0x3b0, lpBuffer=0x4cd6558, nNumberOfBytesToRead=0xfd287, lpNumberOfBytesRead=0x10af1f4, lpOverlapped=0x0 | out: lpBuffer=0x4cd6558*, lpNumberOfBytesRead=0x10af1f4*=0xfd287, lpOverlapped=0x0) returned 1 [0109.068] CloseHandle (hObject=0x3b0) returned 1 [0109.241] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\stream.x64.en-us.man.dat.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec34, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\stream.x64.en-us.man.dat.ForgiveME", lpFilePart=0x0) returned 0x84 [0109.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af128) returned 1 [0109.242] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\stream.x64.en-us.man.dat.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\f227e87a-b6b1-42dd-93d7-cc66c1f69c7e\\en-us.16\\stream.x64.en-us.man.dat.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0109.243] GetFileType (hFile=0x3b0) returned 0x1 [0109.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af124) returned 1 [0109.243] GetFileType (hFile=0x3b0) returned 0x1 [0109.243] WriteFile (in: hFile=0x3b0, lpBuffer=0xf8f1d88*, nNumberOfBytesToWrite=0xfd290, lpNumberOfBytesWritten=0x10af1e4, lpOverlapped=0x0 | out: lpBuffer=0xf8f1d88*, lpNumberOfBytesWritten=0x10af1e4*=0xfd290, lpOverlapped=0x0) returned 1 [0109.275] CloseHandle (hObject=0x3b0) returned 1 [0109.288] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\stream.x64.en-us.man.dat", nBufferLength=0x105, lpBuffer=0x10aed94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\stream.x64.en-us.man.dat", lpFilePart=0x0) returned 0x7a [0109.288] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\f227e87a-b6b1-42dd-93d7-cc66c1f69c7e\\en-us.16\\stream.x64.en-us.man.dat")) returned 1 [0109.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af25c) returned 1 [0109.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16", lpFilePart=0x0) returned 0x62 [0109.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16\\", lpFilePart=0x0) returned 0x63 [0109.297] FindClose (in: hFindFile=0x145ce88 | out: hFindFile=0x145ce88) returned 1 [0109.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0109.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af228) returned 1 [0109.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af25c) returned 1 [0109.298] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16", nBufferLength=0x105, lpBuffer=0x10aed64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16", lpFilePart=0x0) returned 0x62 [0109.298] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16\\", nBufferLength=0x105, lpBuffer=0x10aed38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16\\", lpFilePart=0x0) returned 0x63 [0109.299] FindClose (in: hFindFile=0x145cc08 | out: hFindFile=0x145cc08) returned 1 [0109.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af21c) returned 1 [0109.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af228) returned 1 [0109.332] ReadFile (in: hFile=0x3b0, lpBuffer=0x13024ad8, nNumberOfBytesToRead=0x977db8, lpNumberOfBytesRead=0x10af1f4, lpOverlapped=0x0 | out: lpBuffer=0x13024ad8*, lpNumberOfBytesRead=0x10af1f4*=0x977db8, lpOverlapped=0x0) returned 1 [0109.981] CloseHandle (hObject=0x3b0) returned 1 [0112.558] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16\\stream.x64.x-none.man.dat.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec34, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16\\stream.x64.x-none.man.dat.ForgiveME", lpFilePart=0x0) returned 0x86 [0112.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af128) returned 1 [0112.558] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16\\stream.x64.x-none.man.dat.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\f227e87a-b6b1-42dd-93d7-cc66c1f69c7e\\x-none.16\\stream.x64.x-none.man.dat.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0112.559] GetFileType (hFile=0x3b0) returned 0x1 [0112.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af124) returned 1 [0112.559] GetFileType (hFile=0x3b0) returned 0x1 [0112.559] WriteFile (in: hFile=0x3b0, lpBuffer=0xbe96198*, nNumberOfBytesToWrite=0x5128c0, lpNumberOfBytesWritten=0x10af1e4, lpOverlapped=0x0 | out: lpBuffer=0xbe96198*, lpNumberOfBytesWritten=0x10af1e4*=0x5128c0, lpOverlapped=0x0) returned 1 [0112.619] CloseHandle (hObject=0x3b0) returned 1 [0112.720] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16\\stream.x64.x-none.man.dat", nBufferLength=0x105, lpBuffer=0x10aed94, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16\\stream.x64.x-none.man.dat", lpFilePart=0x0) returned 0x7c [0112.720] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\ProductReleases\\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\programdata\\microsoft\\clicktorun\\productreleases\\f227e87a-b6b1-42dd-93d7-cc66c1f69c7e\\x-none.16\\stream.x64.x-none.man.dat")) returned 1 [0112.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0112.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData", lpFilePart=0x0) returned 0x2c [0112.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\", lpFilePart=0x0) returned 0x2d [0112.721] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0112.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0112.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0112.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0112.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData", lpFilePart=0x0) returned 0x2c [0112.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\UserData\\", lpFilePart=0x0) returned 0x2d [0112.722] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0112.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0112.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0112.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0112.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpFilePart=0x0) returned 0x4a [0112.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpFilePart=0x0) returned 0x4b [0112.838] FindClose (in: hFindFile=0x145c848 | out: hFindFile=0x145c848) returned 1 [0112.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0112.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0112.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0112.839] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpFilePart=0x0) returned 0x4a [0112.839] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\", lpFilePart=0x0) returned 0x4b [0112.844] FindClose (in: hFindFile=0x145cc08 | out: hFindFile=0x145cc08) returned 1 [0112.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0112.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0113.003] ReadFile (in: hFile=0x3b0, lpBuffer=0x4d4ee08, nNumberOfBytesToRead=0x87086, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x4d4ee08*, lpNumberOfBytesRead=0x10af26c*=0x87086, lpOverlapped=0x0) returned 1 [0113.024] CloseHandle (hObject=0x3b0) returned 1 [0113.068] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.ForgiveME", lpFilePart=0x0) returned 0x85 [0113.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0113.068] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0113.068] GetFileType (hFile=0x3b0) returned 0x1 [0113.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0113.068] GetFileType (hFile=0x3b0) returned 0x1 [0113.069] WriteFile (in: hFile=0x3b0, lpBuffer=0xc6061d8*, nNumberOfBytesToWrite=0x87090, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0xc6061d8*, lpNumberOfBytesWritten=0x10af25c*=0x87090, lpOverlapped=0x0) returned 1 [0113.075] CloseHandle (hObject=0x3b0) returned 1 [0113.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b [0113.082] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml")) returned 1 [0113.178] ReadFile (in: hFile=0x3b0, lpBuffer=0x4dd5eb0, nNumberOfBytesToRead=0x19e62, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x4dd5eb0*, lpNumberOfBytesRead=0x10af26c*=0x19e62, lpOverlapped=0x0) returned 1 [0113.191] CloseHandle (hObject=0x3b0) returned 1 [0113.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.ForgiveME", lpFilePart=0x0) returned 0x83 [0113.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0113.212] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0113.212] GetFileType (hFile=0x3b0) returned 0x1 [0113.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0113.212] GetFileType (hFile=0x3b0) returned 0x1 [0113.212] WriteFile (in: hFile=0x3b0, lpBuffer=0xc6c0f68*, nNumberOfBytesToWrite=0x19e70, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0xc6c0f68*, lpNumberOfBytesWritten=0x10af25c*=0x19e70, lpOverlapped=0x0) returned 1 [0113.213] CloseHandle (hObject=0x3b0) returned 1 [0113.216] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x79 [0113.216] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml")) returned 1 [0113.264] ReadFile (in: hFile=0x3b0, lpBuffer=0xc6dadf8, nNumberOfBytesToRead=0x53f4e, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0xc6dadf8*, lpNumberOfBytesRead=0x10af26c*=0x53f4e, lpOverlapped=0x0) returned 1 [0113.297] CloseHandle (hObject=0x3b0) returned 1 [0113.330] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.ForgiveME", lpFilePart=0x0) returned 0x7d [0113.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0113.330] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0113.330] GetFileType (hFile=0x3b0) returned 0x1 [0113.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0113.331] GetFileType (hFile=0x3b0) returned 0x1 [0113.331] WriteFile (in: hFile=0x3b0, lpBuffer=0xc87eac8*, nNumberOfBytesToWrite=0x53f50, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0xc87eac8*, lpNumberOfBytesWritten=0x10af25c*=0x53f50, lpOverlapped=0x0) returned 1 [0113.334] CloseHandle (hObject=0x3b0) returned 1 [0113.339] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", lpFilePart=0x0) returned 0x73 [0113.339] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml")) returned 1 [0113.342] ReadFile (in: hFile=0x3b0, lpBuffer=0xc8d2a38, nNumberOfBytesToRead=0x1ef78, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0xc8d2a38*, lpNumberOfBytesRead=0x10af26c*=0x1ef78, lpOverlapped=0x0) returned 1 [0113.356] CloseHandle (hObject=0x3b0) returned 1 [0113.376] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.ForgiveME", lpFilePart=0x0) returned 0x7b [0113.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0113.376] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0113.377] GetFileType (hFile=0x3b0) returned 0x1 [0113.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0113.377] GetFileType (hFile=0x3b0) returned 0x1 [0113.377] WriteFile (in: hFile=0x3b0, lpBuffer=0xc96d7f0*, nNumberOfBytesToWrite=0x1ef80, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0xc96d7f0*, lpNumberOfBytesWritten=0x10af25c*=0x1ef80, lpOverlapped=0x0) returned 1 [0113.378] CloseHandle (hObject=0x3b0) returned 1 [0113.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x71 [0113.380] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml")) returned 1 [0113.418] ReadFile (in: hFile=0x3b0, lpBuffer=0xc98c790, nNumberOfBytesToRead=0x18088, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0xc98c790*, lpNumberOfBytesRead=0x10af26c*=0x18088, lpOverlapped=0x0) returned 1 [0113.501] CloseHandle (hObject=0x3b0) returned 1 [0113.519] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.ForgiveME", lpFilePart=0x0) returned 0x89 [0113.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0113.519] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0113.520] GetFileType (hFile=0x3b0) returned 0x1 [0113.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0113.520] GetFileType (hFile=0x3b0) returned 0x1 [0113.520] WriteFile (in: hFile=0x3b0, lpBuffer=0xca04a98*, nNumberOfBytesToWrite=0x18090, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0xca04a98*, lpNumberOfBytesWritten=0x10af25c*=0x18090, lpOverlapped=0x0) returned 1 [0113.521] CloseHandle (hObject=0x3b0) returned 1 [0113.523] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0113.523] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml")) returned 1 [0113.739] ReadFile (in: hFile=0x3b0, lpBuffer=0xca1cb48, nNumberOfBytesToRead=0x17eb6, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0xca1cb48*, lpNumberOfBytesRead=0x10af26c*=0x17eb6, lpOverlapped=0x0) returned 1 [0113.747] CloseHandle (hObject=0x3b0) returned 1 [0113.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.ForgiveME", lpFilePart=0x0) returned 0x89 [0113.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0113.766] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0113.767] GetFileType (hFile=0x3b0) returned 0x1 [0113.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0113.767] GetFileType (hFile=0x3b0) returned 0x1 [0113.767] WriteFile (in: hFile=0x3b0, lpBuffer=0xca94540*, nNumberOfBytesToWrite=0x17ec0, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0xca94540*, lpNumberOfBytesWritten=0x10af25c*=0x17ec0, lpOverlapped=0x0) returned 1 [0113.768] CloseHandle (hObject=0x3b0) returned 1 [0113.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0113.770] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml")) returned 1 [0113.772] ReadFile (in: hFile=0x3b0, lpBuffer=0xcaac420, nNumberOfBytesToRead=0x17a74, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0xcaac420*, lpNumberOfBytesRead=0x10af26c*=0x17a74, lpOverlapped=0x0) returned 1 [0113.774] CloseHandle (hObject=0x3b0) returned 1 [0113.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.ForgiveME", lpFilePart=0x0) returned 0x7c [0113.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0113.794] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0113.794] GetFileType (hFile=0x3b0) returned 0x1 [0113.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0113.794] GetFileType (hFile=0x3b0) returned 0x1 [0113.794] WriteFile (in: hFile=0x3b0, lpBuffer=0xcb228d0*, nNumberOfBytesToWrite=0x17a80, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0xcb228d0*, lpNumberOfBytesWritten=0x10af25c*=0x17a80, lpOverlapped=0x0) returned 1 [0113.796] CloseHandle (hObject=0x3b0) returned 1 [0113.798] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72 [0113.798] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml")) returned 1 [0113.800] ReadFile (in: hFile=0x3b0, lpBuffer=0xcb3a370, nNumberOfBytesToRead=0xc6a24, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0xcb3a370*, lpNumberOfBytesRead=0x10af26c*=0xc6a24, lpOverlapped=0x0) returned 1 [0113.836] CloseHandle (hObject=0x3b0) returned 1 [0113.895] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.ForgiveME", lpFilePart=0x0) returned 0x8f [0113.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0113.895] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0113.896] GetFileType (hFile=0x3b0) returned 0x1 [0113.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0113.896] GetFileType (hFile=0x3b0) returned 0x1 [0113.896] WriteFile (in: hFile=0x3b0, lpBuffer=0xcf1b690*, nNumberOfBytesToWrite=0xc6a30, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0xcf1b690*, lpNumberOfBytesWritten=0x10af25c*=0xc6a30, lpOverlapped=0x0) returned 1 [0113.904] CloseHandle (hObject=0x3b0) returned 1 [0113.914] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x85 [0113.914] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml")) returned 1 [0113.920] ReadFile (in: hFile=0x3b0, lpBuffer=0xcfe20e0, nNumberOfBytesToRead=0x1a992, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0xcfe20e0*, lpNumberOfBytesRead=0x10af26c*=0x1a992, lpOverlapped=0x0) returned 1 [0113.922] CloseHandle (hObject=0x3b0) returned 1 [0113.942] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.ForgiveME", lpFilePart=0x0) returned 0x8f [0113.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0113.942] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0113.943] GetFileType (hFile=0x3b0) returned 0x1 [0113.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0113.943] GetFileType (hFile=0x3b0) returned 0x1 [0113.943] WriteFile (in: hFile=0x3b0, lpBuffer=0xd067130*, nNumberOfBytesToWrite=0x1a9a0, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0xd067130*, lpNumberOfBytesWritten=0x10af25c*=0x1a9a0, lpOverlapped=0x0) returned 1 [0113.944] CloseHandle (hObject=0x3b0) returned 1 [0113.946] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x85 [0113.946] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml")) returned 1 [0114.235] ReadFile (in: hFile=0x3b0, lpBuffer=0xd0a8ad0, nNumberOfBytesToRead=0xb7a6c, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0xd0a8ad0*, lpNumberOfBytesRead=0x10af26c*=0xb7a6c, lpOverlapped=0x0) returned 1 [0114.273] CloseHandle (hObject=0x3b0) returned 1 [0114.634] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.ForgiveME", lpFilePart=0x0) returned 0x85 [0114.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0114.634] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.635] GetFileType (hFile=0x3b0) returned 0x1 [0114.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0114.635] GetFileType (hFile=0x3b0) returned 0x1 [0114.635] WriteFile (in: hFile=0x3b0, lpBuffer=0xc471018*, nNumberOfBytesToWrite=0x2f170, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0xc471018*, lpNumberOfBytesWritten=0x10af25c*=0x2f170, lpOverlapped=0x0) returned 1 [0114.637] CloseHandle (hObject=0x3b0) returned 1 [0114.640] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b [0114.640] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml")) returned 1 [0114.642] ReadFile (in: hFile=0x3b0, lpBuffer=0xc4a01a8, nNumberOfBytesToRead=0x118932, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0xc4a01a8*, lpNumberOfBytesRead=0x10af26c*=0x118932, lpOverlapped=0x0) returned 1 [0114.676] CloseHandle (hObject=0x3b0) returned 1 [0114.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.ForgiveME", lpFilePart=0x0) returned 0x7a [0114.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0114.771] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.771] GetFileType (hFile=0x3b0) returned 0x1 [0114.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0114.771] GetFileType (hFile=0x3b0) returned 0x1 [0114.771] WriteFile (in: hFile=0x3b0, lpBuffer=0x41434a0*, nNumberOfBytesToWrite=0x118940, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x41434a0*, lpNumberOfBytesWritten=0x10af25c*=0x118940, lpOverlapped=0x0) returned 1 [0114.785] CloseHandle (hObject=0x3b0) returned 1 [0114.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x70 [0114.801] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml")) returned 1 [0114.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x79 [0114.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1b8) returned 1 [0114.802] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.803] GetFileType (hFile=0x3b0) returned 0x1 [0114.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0114.803] GetFileType (hFile=0x3b0) returned 0x1 [0114.803] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x167aa [0114.824] ReadFile (in: hFile=0x3b0, lpBuffer=0x3df98d0, nNumberOfBytesToRead=0x167aa, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x3df98d0*, lpNumberOfBytesRead=0x10af26c*=0x167aa, lpOverlapped=0x0) returned 1 [0114.829] CloseHandle (hObject=0x3b0) returned 1 [0114.848] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.ForgiveME", lpFilePart=0x0) returned 0x83 [0114.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0114.848] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.848] GetFileType (hFile=0x3b0) returned 0x1 [0114.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0114.849] GetFileType (hFile=0x3b0) returned 0x1 [0114.849] WriteFile (in: hFile=0x3b0, lpBuffer=0x3e69f78*, nNumberOfBytesToWrite=0x167b0, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x3e69f78*, lpNumberOfBytesWritten=0x10af25c*=0x167b0, lpOverlapped=0x0) returned 1 [0114.850] CloseHandle (hObject=0x3b0) returned 1 [0114.852] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x79 [0114.852] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml")) returned 1 [0114.853] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6f [0114.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1b8) returned 1 [0114.853] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.853] GetFileType (hFile=0x3b0) returned 0x1 [0114.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0114.853] GetFileType (hFile=0x3b0) returned 0x1 [0114.853] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0x13162 [0114.854] ReadFile (in: hFile=0x3b0, lpBuffer=0x2e59dc0, nNumberOfBytesToRead=0x13162, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2e59dc0*, lpNumberOfBytesRead=0x10af26c*=0x13162, lpOverlapped=0x0) returned 1 [0114.861] CloseHandle (hObject=0x3b0) returned 1 [0114.877] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.ForgiveME", lpFilePart=0x0) returned 0x79 [0114.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0114.877] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.878] GetFileType (hFile=0x3b0) returned 0x1 [0114.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0114.878] GetFileType (hFile=0x3b0) returned 0x1 [0114.878] WriteFile (in: hFile=0x3b0, lpBuffer=0x2ee0134*, nNumberOfBytesToWrite=0x13170, lpNumberOfBytesWritten=0x10af25c, lpOverlapped=0x0 | out: lpBuffer=0x2ee0134*, lpNumberOfBytesWritten=0x10af25c*=0x13170, lpOverlapped=0x0) returned 1 [0114.880] CloseHandle (hObject=0x3b0) returned 1 [0114.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x6f [0114.881] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml")) returned 1 [0114.883] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml", lpFilePart=0x0) returned 0x80 [0114.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1b8) returned 1 [0114.883] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officebackgroundtaskhandlerlogon.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.883] GetFileType (hFile=0x3b0) returned 0x1 [0114.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0114.883] GetFileType (hFile=0x3b0) returned 0x1 [0114.883] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0xb00 [0114.883] ReadFile (in: hFile=0x3b0, lpBuffer=0x2ef42fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2ef42fc*, lpNumberOfBytesRead=0x10af26c*=0xb00, lpOverlapped=0x0) returned 1 [0114.893] CloseHandle (hObject=0x3b0) returned 1 [0114.906] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml.ForgiveME", lpFilePart=0x0) returned 0x8a [0114.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0114.907] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officebackgroundtaskhandlerlogon.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.907] GetFileType (hFile=0x3b0) returned 0x1 [0114.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0114.907] GetFileType (hFile=0x3b0) returned 0x1 [0114.907] WriteFile (in: hFile=0x3b0, lpBuffer=0x2f45ba4*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x2f45ba4*, lpNumberOfBytesWritten=0x10af230*=0xb10, lpOverlapped=0x0) returned 1 [0114.908] CloseHandle (hObject=0x3b0) returned 1 [0114.908] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml", lpFilePart=0x0) returned 0x80 [0114.908] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officebackgroundtaskhandlerlogon.xml")) returned 1 [0114.909] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml", lpFilePart=0x0) returned 0x87 [0114.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1b8) returned 1 [0114.910] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officebackgroundtaskhandlerregistration.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.910] GetFileType (hFile=0x3b0) returned 0x1 [0114.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0114.910] GetFileType (hFile=0x3b0) returned 0x1 [0114.910] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0xbbc [0114.910] ReadFile (in: hFile=0x3b0, lpBuffer=0x2f47adc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2f47adc*, lpNumberOfBytesRead=0x10af26c*=0xbbc, lpOverlapped=0x0) returned 1 [0114.914] CloseHandle (hObject=0x3b0) returned 1 [0114.927] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml.ForgiveME", lpFilePart=0x0) returned 0x91 [0114.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0114.927] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officebackgroundtaskhandlerregistration.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.928] GetFileType (hFile=0x3b0) returned 0x1 [0114.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0114.928] GetFileType (hFile=0x3b0) returned 0x1 [0114.928] WriteFile (in: hFile=0x3b0, lpBuffer=0x2f99710*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x2f99710*, lpNumberOfBytesWritten=0x10af230*=0xbc0, lpOverlapped=0x0) returned 1 [0114.928] CloseHandle (hObject=0x3b0) returned 1 [0114.929] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml", lpFilePart=0x0) returned 0x87 [0114.929] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officebackgroundtaskhandlerregistration.xml")) returned 1 [0114.930] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeOsfInstaller.xml", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeOsfInstaller.xml", lpFilePart=0x0) returned 0x72 [0114.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1b8) returned 1 [0114.930] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeOsfInstaller.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officeosfinstaller.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.930] GetFileType (hFile=0x3b0) returned 0x1 [0114.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0114.930] GetFileType (hFile=0x3b0) returned 0x1 [0114.930] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0xe08 [0114.930] ReadFile (in: hFile=0x3b0, lpBuffer=0x2f9b84c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2f9b84c*, lpNumberOfBytesRead=0x10af26c*=0xe08, lpOverlapped=0x0) returned 1 [0114.937] CloseHandle (hObject=0x3b0) returned 1 [0114.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeOsfInstaller.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeOsfInstaller.xml.ForgiveME", lpFilePart=0x0) returned 0x7c [0114.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0114.951] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeOsfInstaller.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officeosfinstaller.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.951] GetFileType (hFile=0x3b0) returned 0x1 [0114.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0114.951] GetFileType (hFile=0x3b0) returned 0x1 [0114.951] WriteFile (in: hFile=0x3b0, lpBuffer=0x2fedf98*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x2fedf98*, lpNumberOfBytesWritten=0x10af230*=0xe10, lpOverlapped=0x0) returned 1 [0114.952] CloseHandle (hObject=0x3b0) returned 1 [0114.953] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeOsfInstaller.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeOsfInstaller.xml", lpFilePart=0x0) returned 0x72 [0114.953] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeOsfInstaller.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officeosfinstaller.xml")) returned 1 [0114.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpFilePart=0x0) returned 0x80 [0114.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1b8) returned 1 [0114.954] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.955] GetFileType (hFile=0x3b0) returned 0x1 [0114.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0114.955] GetFileType (hFile=0x3b0) returned 0x1 [0114.955] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0xce8 [0114.955] ReadFile (in: hFile=0x3b0, lpBuffer=0x2feffc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2feffc4*, lpNumberOfBytesRead=0x10af26c*=0xce8, lpOverlapped=0x0) returned 1 [0114.956] CloseHandle (hObject=0x3b0) returned 1 [0114.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.ForgiveME", lpFilePart=0x0) returned 0x8a [0114.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0114.972] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.972] GetFileType (hFile=0x3b0) returned 0x1 [0114.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0114.972] GetFileType (hFile=0x3b0) returned 0x1 [0114.972] WriteFile (in: hFile=0x3b0, lpBuffer=0x2e454f8*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x2e454f8*, lpNumberOfBytesWritten=0x10af230*=0xcf0, lpOverlapped=0x0) returned 1 [0114.973] CloseHandle (hObject=0x3b0) returned 1 [0114.974] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpFilePart=0x0) returned 0x80 [0114.974] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml")) returned 1 [0114.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", nBufferLength=0x105, lpBuffer=0x10aecc4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFilePart=0x0) returned 0x7d [0114.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1b8) returned 1 [0114.975] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.975] GetFileType (hFile=0x3b0) returned 0x1 [0114.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af1b4) returned 1 [0114.975] GetFileType (hFile=0x3b0) returned 0x1 [0114.975] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x10af2c0 | out: lpFileSizeHigh=0x10af2c0*=0x0) returned 0xca6 [0114.975] ReadFile (in: hFile=0x3b0, lpBuffer=0x2e474f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x2e474f4*, lpNumberOfBytesRead=0x10af26c*=0xca6, lpOverlapped=0x0) returned 1 [0114.984] CloseHandle (hObject=0x3b0) returned 1 [0114.998] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.ForgiveME", lpFilePart=0x0) returned 0x87 [0114.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0114.998] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.ForgiveME" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0114.999] GetFileType (hFile=0x3b0) returned 0x1 [0114.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0114.999] GetFileType (hFile=0x3b0) returned 0x1 [0114.999] WriteFile (in: hFile=0x3b0, lpBuffer=0x2e99700*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x2e99700*, lpNumberOfBytesWritten=0x10af230*=0xcb0, lpOverlapped=0x0) returned 1 [0114.999] CloseHandle (hObject=0x3b0) returned 1 [0115.000] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", nBufferLength=0x105, lpBuffer=0x10aee0c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFilePart=0x0) returned 0x7d [0115.000] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\programdata\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml")) returned 1 [0115.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0115.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x20 [0115.001] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145ce88 [0115.001] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.001] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.002] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.002] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.002] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.002] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.002] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.002] FindClose (in: hFindFile=0x145ce88 | out: hFindFile=0x145ce88) returned 1 [0115.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0115.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0115.002] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0115.002] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x20 [0115.002] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cb08 [0115.003] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.003] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.003] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.003] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.003] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.003] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.003] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.003] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0115.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0115.003] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0115.003] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x24 [0115.003] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb08 [0115.004] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.004] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.004] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.004] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0115.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0115.004] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0115.004] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x24 [0115.004] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb08 [0115.004] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.004] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.005] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.006] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0115.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0115.006] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0115.006] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0115.006] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145c848 [0115.006] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.006] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.007] FindClose (in: hFindFile=0x145c848 | out: hFindFile=0x145c848) returned 1 [0115.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0115.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0115.007] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0115.007] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0115.007] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cb08 [0115.007] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.007] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.007] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0115.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0115.008] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0115.008] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x25 [0115.008] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb08 [0115.008] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.009] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.009] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0115.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0115.009] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0115.009] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x25 [0115.009] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb88 [0115.009] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.009] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.009] FindClose (in: hFindFile=0x145cb88 | out: hFindFile=0x145cb88) returned 1 [0115.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0115.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0115.010] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP", lpFilePart=0x0) returned 0x26 [0115.010] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\", lpFilePart=0x0) returned 0x27 [0115.010] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cc08 [0115.010] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.010] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.010] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.010] FindClose (in: hFindFile=0x145cc08 | out: hFindFile=0x145cc08) returned 1 [0115.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0115.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0115.011] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP", lpFilePart=0x0) returned 0x26 [0115.011] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\", lpFilePart=0x0) returned 0x27 [0115.011] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb08 [0115.012] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.012] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.012] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.012] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0115.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0115.012] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", lpFilePart=0x0) returned 0x31 [0115.012] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\", lpFilePart=0x0) returned 0x32 [0115.012] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cc08 [0115.012] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.012] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.013] FindClose (in: hFindFile=0x145cc08 | out: hFindFile=0x145cc08) returned 1 [0115.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0115.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0115.013] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", lpFilePart=0x0) returned 0x31 [0115.013] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\", lpFilePart=0x0) returned 0x32 [0115.013] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145ce48 [0115.013] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.013] FindNextFileW (in: hFindFile=0x145ce48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.013] FindClose (in: hFindFile=0x145ce48 | out: hFindFile=0x145ce48) returned 1 [0115.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0115.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0115.013] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0115.013] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x24 [0115.013] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cd48 [0115.014] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.014] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.014] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.014] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.014] FindClose (in: hFindFile=0x145cd48 | out: hFindFile=0x145cd48) returned 1 [0115.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0115.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0115.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0115.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x24 [0115.014] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb08 [0115.015] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.015] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.015] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.015] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.015] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0115.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0115.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0115.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0115.015] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145c9c8 [0115.015] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.016] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.016] FindClose (in: hFindFile=0x145c9c8 | out: hFindFile=0x145c9c8) returned 1 [0115.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af264) returned 1 [0115.017] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0115.017] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0115.018] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cd48 [0115.018] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.018] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.018] FindClose (in: hFindFile=0x145cd48 | out: hFindFile=0x145cd48) returned 1 [0115.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.018] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c [0115.018] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x2d [0115.018] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cd48 [0115.019] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.019] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.019] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.019] FindClose (in: hFindFile=0x145cd48 | out: hFindFile=0x145cd48) returned 1 [0115.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.019] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c [0115.019] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x2d [0115.019] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145c808 [0115.020] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.020] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.020] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.020] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0115.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.020] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys", lpFilePart=0x0) returned 0x2a [0115.020] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\", lpFilePart=0x0) returned 0x2b [0115.020] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c908 [0115.020] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.021] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.021] FindNextFileW (in: hFindFile=0x145c908, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.021] FindClose (in: hFindFile=0x145c908 | out: hFindFile=0x145c908) returned 1 [0115.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.021] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys", lpFilePart=0x0) returned 0x2a [0115.021] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\", lpFilePart=0x0) returned 0x2b [0115.021] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c808 [0115.021] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.021] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.021] FindNextFileW (in: hFindFile=0x145c808, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.022] FindClose (in: hFindFile=0x145c808 | out: hFindFile=0x145c808) returned 1 [0115.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.022] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DataMart", lpFilePart=0x0) returned 0x21 [0115.022] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DataMart\\", lpFilePart=0x0) returned 0x22 [0115.022] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c708 [0115.022] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.022] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.022] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.022] FindClose (in: hFindFile=0x145c708 | out: hFindFile=0x145c708) returned 1 [0115.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.022] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DataMart", lpFilePart=0x0) returned 0x21 [0115.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DataMart\\", lpFilePart=0x0) returned 0x22 [0115.023] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c848 [0115.023] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.023] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.023] FindNextFileW (in: hFindFile=0x145c848, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.023] FindClose (in: hFindFile=0x145c848 | out: hFindFile=0x145c848) returned 1 [0115.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi", lpFilePart=0x0) returned 0x2a [0115.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\", lpFilePart=0x0) returned 0x2b [0115.023] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cd48 [0115.024] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.024] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.024] FindClose (in: hFindFile=0x145cd48 | out: hFindFile=0x145cd48) returned 1 [0115.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.024] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi", lpFilePart=0x0) returned 0x2a [0115.024] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\", lpFilePart=0x0) returned 0x2b [0115.024] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DataMart\\PaidWiFi\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cc08 [0115.024] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.024] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.024] FindClose (in: hFindFile=0x145cc08 | out: hFindFile=0x145cc08) returned 1 [0115.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.025] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25 [0115.025] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x26 [0115.025] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145ce08 [0115.025] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.025] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.025] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.026] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.026] FindClose (in: hFindFile=0x145ce08 | out: hFindFile=0x145ce08) returned 1 [0115.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.026] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25 [0115.026] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x26 [0115.026] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cd48 [0115.026] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.026] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.027] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.027] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.027] FindClose (in: hFindFile=0x145cd48 | out: hFindFile=0x145cd48) returned 1 [0115.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.027] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c [0115.027] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x2d [0115.027] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb88 [0115.027] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.027] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.028] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.028] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.028] FindClose (in: hFindFile=0x145cb88 | out: hFindFile=0x145cb88) returned 1 [0115.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.028] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c [0115.028] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x2d [0115.028] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c708 [0115.028] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.028] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.028] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.029] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.029] FindClose (in: hFindFile=0x145c708 | out: hFindFile=0x145c708) returned 1 [0115.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.029] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53 [0115.029] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x54 [0115.029] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cb08 [0115.030] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.030] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.030] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.030] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.030] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.030] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.030] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.031] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53 [0115.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x54 [0115.031] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cb88 [0115.032] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.032] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.032] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.032] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.032] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.032] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.032] FindNextFileW (in: hFindFile=0x145cb88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.032] FindClose (in: hFindFile=0x145cb88 | out: hFindFile=0x145cb88) returned 1 [0115.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x10aec88, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x62 [0115.033] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0115.034] GetFileType (hFile=0x3b0) returned 0x1 [0115.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af178) returned 1 [0115.034] GetFileType (hFile=0x3b0) returned 0x1 [0115.034] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x10af284 | out: lpFileSizeHigh=0x10af284*=0x0) returned 0x1fad1 [0115.034] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ea6a28, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x3ea6a28*, lpNumberOfBytesRead=0x10af230*=0x1fad1, lpOverlapped=0x0) returned 1 [0115.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.ForgiveME", lpFilePart=0x0) returned 0x6c [0115.076] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.ForgiveME" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0115.077] GetFileType (hFile=0x3b0) returned 0x1 [0115.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af160) returned 1 [0115.077] GetFileType (hFile=0x3b0) returned 0x1 [0115.077] WriteFile (in: hFile=0x3b0, lpBuffer=0x3f450b8*, nNumberOfBytesToWrite=0x1fae0, lpNumberOfBytesWritten=0x10af220, lpOverlapped=0x0 | out: lpBuffer=0x3f450b8*, lpNumberOfBytesWritten=0x10af220*=0x1fae0, lpOverlapped=0x0) returned 1 [0115.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x10aedd0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x62 [0115.080] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0 [0115.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0115.081] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53 [0115.081] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x54 [0115.081] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cd48 [0115.082] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.082] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.082] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.082] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.082] FindNextFileW (in: hFindFile=0x145cd48, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.082] FindClose (in: hFindFile=0x145cd48 | out: hFindFile=0x145cd48) returned 1 [0115.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53 [0115.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x54 [0115.082] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cb08 [0115.082] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.082] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.082] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.082] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.082] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.083] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.083] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x10aec88, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x62 [0115.083] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0115.083] GetFileType (hFile=0x3b0) returned 0x1 [0115.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af178) returned 1 [0115.083] GetFileType (hFile=0x3b0) returned 0x1 [0115.083] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x10af284 | out: lpFileSizeHigh=0x10af284*=0x0) returned 0x1fad1 [0115.083] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f64bb8, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x3f64bb8*, lpNumberOfBytesRead=0x10af230*=0x1fad1, lpOverlapped=0x0) returned 1 [0115.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.ForgiveME", lpFilePart=0x0) returned 0x6c [0115.119] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.ForgiveME" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0115.121] GetFileType (hFile=0x3b0) returned 0x1 [0115.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af160) returned 1 [0115.122] GetFileType (hFile=0x3b0) returned 0x1 [0115.122] WriteFile (in: hFile=0x3b0, lpBuffer=0x4003248*, nNumberOfBytesToWrite=0x1fae0, lpNumberOfBytesWritten=0x10af220, lpOverlapped=0x0 | out: lpBuffer=0x4003248*, lpNumberOfBytesWritten=0x10af220*=0x1fae0, lpOverlapped=0x0) returned 1 [0115.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x10aedd0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x62 [0115.123] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0 [0115.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0115.125] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2a [0115.125] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2b [0115.125] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb08 [0115.126] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.126] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.126] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.126] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.126] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.126] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2a [0115.126] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2b [0115.126] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145ce08 [0115.127] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.127] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.127] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.127] FindNextFileW (in: hFindFile=0x145ce08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.127] FindClose (in: hFindFile=0x145ce08 | out: hFindFile=0x145ce08) returned 1 [0115.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x51 [0115.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x52 [0115.127] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145c708 [0115.128] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.128] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.128] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.128] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.128] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.128] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.128] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.128] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.128] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.128] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.129] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.129] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.129] FindClose (in: hFindFile=0x145c708 | out: hFindFile=0x145c708) returned 1 [0115.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.129] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x51 [0115.129] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x52 [0115.129] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cc08 [0115.130] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.130] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.130] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.130] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.130] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.130] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.130] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.130] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.130] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.130] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.130] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.130] FindNextFileW (in: hFindFile=0x145cc08, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.130] FindClose (in: hFindFile=0x145cc08 | out: hFindFile=0x145cc08) returned 1 [0115.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", nBufferLength=0x105, lpBuffer=0x10aec88, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFilePart=0x0) returned 0x5c [0115.131] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0115.132] GetFileType (hFile=0x3b0) returned 0x1 [0115.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af178) returned 1 [0115.132] GetFileType (hFile=0x3b0) returned 0x1 [0115.132] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x10af284 | out: lpFileSizeHigh=0x10af284*=0x0) returned 0xd0a3 [0115.132] ReadFile (in: hFile=0x3b0, lpBuffer=0x2f50308, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x2f50308*, lpNumberOfBytesRead=0x10af230*=0xd0a3, lpOverlapped=0x0) returned 1 [0115.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.ForgiveME", lpFilePart=0x0) returned 0x66 [0115.167] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.ForgiveME" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0115.168] GetFileType (hFile=0x3b0) returned 0x1 [0115.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af160) returned 1 [0115.168] GetFileType (hFile=0x3b0) returned 0x1 [0115.168] WriteFile (in: hFile=0x3b0, lpBuffer=0x2fc4418*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x10af220, lpOverlapped=0x0 | out: lpBuffer=0x2fc4418*, lpNumberOfBytesWritten=0x10af220*=0xd0b0, lpOverlapped=0x0) returned 1 [0115.169] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", nBufferLength=0x105, lpBuffer=0x10aedd0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFilePart=0x0) returned 0x5c [0115.169] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0 [0115.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af298) returned 1 [0115.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x51 [0115.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x52 [0115.170] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145c708 [0115.171] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.172] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.172] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.172] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.172] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.172] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.172] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.172] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.172] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.172] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.172] FindNextFileW (in: hFindFile=0x145c708, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.172] FindClose (in: hFindFile=0x145c708 | out: hFindFile=0x145c708) returned 1 [0115.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.173] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x51 [0115.173] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x52 [0115.173] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145c988 [0115.173] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.174] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.174] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.174] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.174] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.174] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.174] FindNextFileW (in: hFindFile=0x145c988, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.174] FindClose (in: hFindFile=0x145c988 | out: hFindFile=0x145c988) returned 1 [0115.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", nBufferLength=0x105, lpBuffer=0x10aec88, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFilePart=0x0) returned 0x5c [0115.174] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0115.175] GetFileType (hFile=0x3b0) returned 0x1 [0115.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af178) returned 1 [0115.175] GetFileType (hFile=0x3b0) returned 0x1 [0115.175] GetFileSize (in: hFile=0x3b0, lpFileSizeHigh=0x10af284 | out: lpFileSizeHigh=0x10af284*=0x0) returned 0xd0a3 [0115.175] ReadFile (in: hFile=0x3b0, lpBuffer=0x2fd571c, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x2fd571c*, lpNumberOfBytesRead=0x10af230*=0xd0a3, lpOverlapped=0x0) returned 1 [0115.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.ForgiveME", lpFilePart=0x0) returned 0x66 [0115.207] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.ForgiveME" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.forgiveme"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b0 [0115.208] GetFileType (hFile=0x3b0) returned 0x1 [0115.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af160) returned 1 [0115.208] GetFileType (hFile=0x3b0) returned 0x1 [0115.208] WriteFile (in: hFile=0x3b0, lpBuffer=0x2e593c8*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x10af220, lpOverlapped=0x0 | out: lpBuffer=0x2e593c8*, lpNumberOfBytesWritten=0x10af220*=0xd0b0, lpOverlapped=0x0) returned 1 [0115.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", nBufferLength=0x105, lpBuffer=0x10aedd0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFilePart=0x0) returned 0x5c [0115.209] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0 [0115.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0115.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x23 [0115.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x24 [0115.211] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cc88 [0115.213] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.213] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.213] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0115.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x23 [0115.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x24 [0115.214] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cb08 [0115.214] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.214] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.214] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis", lpFilePart=0x0) returned 0x22 [0115.214] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpFilePart=0x0) returned 0x23 [0115.215] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c9c8 [0115.215] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.216] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.216] FindClose (in: hFindFile=0x145c9c8 | out: hFindFile=0x145c9c8) returned 1 [0115.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis", lpFilePart=0x0) returned 0x22 [0115.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\", lpFilePart=0x0) returned 0x23 [0115.217] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cc88 [0115.217] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.218] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.218] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0115.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.219] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat", nBufferLength=0x105, lpBuffer=0x10aed00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat", lpFilePart=0x0) returned 0x2c [0115.219] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\programdata\\microsoft\\diagnosis\\parse.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0115.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10adf10) returned 1 [0115.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0115.221] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM", lpFilePart=0x0) returned 0x1c [0115.221] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x1d [0115.221] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cb08 [0115.222] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.222] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.222] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.222] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.222] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM", lpFilePart=0x0) returned 0x1c [0115.222] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x1d [0115.222] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c748 [0115.222] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.222] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.222] FindNextFileW (in: hFindFile=0x145c748, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.222] FindClose (in: hFindFile=0x145c748 | out: hFindFile=0x145c748) returned 1 [0115.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.223] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x23 [0115.223] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x24 [0115.223] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cd88 [0115.223] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.223] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.223] FindClose (in: hFindFile=0x145cd88 | out: hFindFile=0x145cd88) returned 1 [0115.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.223] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x23 [0115.223] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x24 [0115.223] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145ce88 [0115.223] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.223] FindNextFileW (in: hFindFile=0x145ce88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.224] FindClose (in: hFindFile=0x145ce88 | out: hFindFile=0x145ce88) returned 1 [0115.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x25 [0115.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x26 [0115.224] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cc88 [0115.224] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.224] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.224] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.224] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0115.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x25 [0115.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x26 [0115.224] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cd88 [0115.224] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.225] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.225] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.225] FindClose (in: hFindFile=0x145cd88 | out: hFindFile=0x145cd88) returned 1 [0115.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.225] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2b [0115.225] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x2c [0115.225] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145c9c8 [0115.225] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.225] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.225] FindNextFileW (in: hFindFile=0x145c9c8, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.225] FindClose (in: hFindFile=0x145c9c8 | out: hFindFile=0x145c9c8) returned 1 [0115.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.225] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2b [0115.225] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x2c [0115.225] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cd08 [0115.226] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.226] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.226] FindNextFileW (in: hFindFile=0x145cd08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.226] FindClose (in: hFindFile=0x145cd08 | out: hFindFile=0x145cd08) returned 1 [0115.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.226] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x44 [0115.226] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x45 [0115.226] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145cc88 [0115.226] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.226] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.226] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0115.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.226] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x10aeda0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x44 [0115.226] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x10aed74, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x45 [0115.226] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x10aefc0 | out: lpFindFileData=0x10aefc0) returned 0x145c888 [0115.227] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 1 [0115.227] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10aefd0 | out: lpFindFileData=0x10aefd0) returned 0 [0115.227] FindClose (in: hFindFile=0x145c888 | out: hFindFile=0x145c888) returned 1 [0115.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af258) returned 1 [0115.227] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x24 [0115.227] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x25 [0115.227] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145c888 [0115.227] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.227] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.227] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.227] FindNextFileW (in: hFindFile=0x145c888, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.227] FindClose (in: hFindFile=0x145c888 | out: hFindFile=0x145c888) returned 1 [0115.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.227] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x10aee18, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x24 [0115.228] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x10aedec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x25 [0115.228] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x10af038 | out: lpFindFileData=0x10af038) returned 0x145cd88 [0115.228] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.228] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.228] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 1 [0115.228] FindNextFileW (in: hFindFile=0x145cd88, lpFindFileData=0x10af048 | out: lpFindFileData=0x10af048) returned 0 [0115.228] FindClose (in: hFindFile=0x145cd88 | out: hFindFile=0x145cd88) returned 1 [0115.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0115.228] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT", lpFilePart=0x0) returned 0x28 [0115.228] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\", lpFilePart=0x0) returned 0x29 [0115.228] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cc88 [0115.228] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.228] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.228] FindNextFileW (in: hFindFile=0x145cc88, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.229] FindClose (in: hFindFile=0x145cc88 | out: hFindFile=0x145cc88) returned 1 [0115.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.229] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT", lpFilePart=0x0) returned 0x28 [0115.229] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\", lpFilePart=0x0) returned 0x29 [0115.229] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\INT\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb08 [0115.229] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.229] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.229] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.229] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.229] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\production", lpFilePart=0x0) returned 0x2f [0115.229] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\", lpFilePart=0x0) returned 0x30 [0115.229] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb08 [0115.230] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.230] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.230] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.230] FindNextFileW (in: hFindFile=0x145cb08, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 0 [0115.230] FindClose (in: hFindFile=0x145cb08 | out: hFindFile=0x145cb08) returned 1 [0115.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0115.230] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production", nBufferLength=0x105, lpBuffer=0x10aeddc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\production", lpFilePart=0x0) returned 0x2f [0115.230] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\", nBufferLength=0x105, lpBuffer=0x10aedb0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\", lpFilePart=0x0) returned 0x30 [0115.230] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\production\\*", lpFindFileData=0x10aeffc | out: lpFindFileData=0x10aeffc) returned 0x145cb48 [0115.230] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.230] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.230] FindNextFileW (in: hFindFile=0x145cb48, lpFindFileData=0x10af00c | out: lpFindFileData=0x10af00c) returned 1 [0115.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10aded0) returned 1 [0115.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0115.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0115.283] ReadFile (in: hFile=0x3b0, lpBuffer=0x4057008, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x10af1f4, lpOverlapped=0x0 | out: lpBuffer=0x4057008*, lpNumberOfBytesRead=0x10af1f4*=0x100000, lpOverlapped=0x0) returned 1 [0115.411] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.log.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec34, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.log.ForgiveME", lpFilePart=0x0) returned 0x4b [0115.449] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ef9900, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x10af1f4, lpOverlapped=0x0 | out: lpBuffer=0x3ef9900*, lpNumberOfBytesRead=0x10af1f4*=0x100000, lpOverlapped=0x0) returned 1 [0115.554] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00001.log.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec34, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00001.log.ForgiveME", lpFilePart=0x0) returned 0x50 [0115.696] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00002.log.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec34, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00002.log.ForgiveME", lpFilePart=0x0) returned 0x50 [0115.791] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.log.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec34, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.log.ForgiveME", lpFilePart=0x0) returned 0x4e [0115.940] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.ForgiveME", lpFilePart=0x0) returned 0x42 [0116.102] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aece8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.ForgiveME", lpFilePart=0x0) returned 0x41 [0116.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10adeb8) returned 1 [0116.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0116.257] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db.ForgiveME", lpFilePart=0x0) returned 0x40 [0116.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0116.298] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\tokens.dat.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\tokens.dat.ForgiveME", lpFilePart=0x0) returned 0x3d [0116.556] CloseHandle (hObject=0x3b0) returned 1 [0118.254] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec34, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif.ForgiveME", lpFilePart=0x0) returned 0x55 [0118.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0118.258] ReadFile (in: hFile=0x3b0, lpBuffer=0x3e7cbb0, nNumberOfBytesToRead=0x7e148, lpNumberOfBytesRead=0x10af26c, lpOverlapped=0x0 | out: lpBuffer=0x3e7cbb0*, lpNumberOfBytesRead=0x10af26c*=0x7e148, lpOverlapped=0x0) returned 1 [0118.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aecac, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.ForgiveME", lpFilePart=0x0) returned 0x44 [0118.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af1a0) returned 1 [0118.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af19c) returned 1 [0118.327] CloseHandle (hObject=0x3b0) returned 1 [0118.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0118.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0118.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0118.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0118.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0118.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0118.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0118.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af318) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af318) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0118.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0118.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0118.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0118.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0118.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0118.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af318) returned 1 [0118.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0118.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af30c) returned 1 [0118.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af318) returned 1 [0118.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0118.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0118.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0118.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af310) returned 1 [0118.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2d0) returned 1 [0118.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2dc) returned 1 [0118.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0118.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0118.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0118.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0118.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0118.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0118.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0118.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0118.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0118.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2d4) returned 1 [0118.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af294) returned 1 [0118.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x10af2a0) returned 1 [0118.359] ReadFile (in: hFile=0x3b0, lpBuffer=0x3df98d0, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x3df98d0*, lpNumberOfBytesRead=0x10af230*=0x23000, lpOverlapped=0x0) returned 1 [0118.416] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ForgiveME", lpFilePart=0x0) returned 0x90 [0118.423] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ecb980, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x3ecb980*, lpNumberOfBytesRead=0x10af230*=0x25000, lpOverlapped=0x0) returned 1 [0118.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ForgiveME", lpFilePart=0x0) returned 0x98 [0118.465] ReadFile (in: hFile=0x3b0, lpBuffer=0x3fa9a30, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x3fa9a30*, lpNumberOfBytesRead=0x10af230*=0x24000, lpOverlapped=0x0) returned 1 [0118.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.ForgiveME", lpFilePart=0x0) returned 0x93 [0118.511] ReadFile (in: hFile=0x3b0, lpBuffer=0x4081ae0, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x10af230, lpOverlapped=0x0 | out: lpBuffer=0x4081ae0*, lpNumberOfBytesRead=0x10af230*=0x23000, lpOverlapped=0x0) returned 1 [0118.535] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ForgiveME", lpFilePart=0x0) returned 0x98 [0118.715] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ForgiveME", lpFilePart=0x0) returned 0x90 [0118.935] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.ForgiveME", nBufferLength=0x105, lpBuffer=0x10aec70, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.ForgiveME", lpFilePart=0x0) returned 0x96 [0118.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0118.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0119.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0119.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af34c) returned 1 [0119.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af388) returned 1 [0119.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af388) returned 1 [0119.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af320) returned 1 [0119.050] CreateDirectoryW (lpPathName="C:\\WinWOW32" (normalized: "c:\\winwow32"), lpSecurityAttributes=0x0) returned 1 [0119.063] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x0) returned 0x2 [0119.063] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x10af3a0, lpdwDisposition=0x10af428 | out: phkResult=0x10af3a0*=0x3b0, lpdwDisposition=0x10af428*=0x1) returned 0x0 [0119.064] RegQueryValueExW (in: hKey=0x3b0, lpValueName="NoDesktop", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x0, lpData=0x0, lpcbData=0x10af3f0*=0x0) returned 0x2 [0119.064] RegSetValueExW (in: hKey=0x3b0, lpValueName="NoDesktop", Reserved=0x0, dwType=0x1, lpData="1", cbData=0x4 | out: lpData="1") returned 0x0 [0119.064] RegCloseKey (hKey=0x3b0) returned 0x0 [0119.064] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x0) returned 0x2 [0119.064] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x10af3a0, lpdwDisposition=0x10af428 | out: phkResult=0x10af3a0*=0x3b0, lpdwDisposition=0x10af428*=0x1) returned 0x0 [0119.064] RegQueryValueExW (in: hKey=0x3b0, lpValueName="DisableTaskMgr", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x0, lpData=0x0, lpcbData=0x10af3f0*=0x0) returned 0x2 [0119.064] RegSetValueExW (in: hKey=0x3b0, lpValueName="DisableTaskMgr", Reserved=0x0, dwType=0x1, lpData="1", cbData=0x4 | out: lpData="1") returned 0x0 [0119.064] RegCloseKey (hKey=0x3b0) returned 0x0 [0119.065] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x3b0) returned 0x0 [0119.065] RegQueryValueExW (in: hKey=0x3b0, lpValueName="DisableCMD", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x0, lpData=0x0, lpcbData=0x10af3f0*=0x0) returned 0x2 [0119.065] RegSetValueExW (in: hKey=0x3b0, lpValueName="DisableCMD", Reserved=0x0, dwType=0x1, lpData="1", cbData=0x4 | out: lpData="1") returned 0x0 [0119.065] RegCloseKey (hKey=0x3b0) returned 0x0 [0119.065] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x3b0) returned 0x0 [0119.065] RegQueryValueExW (in: hKey=0x3b0, lpValueName="NoControlPanel", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x0, lpData=0x0, lpcbData=0x10af3f0*=0x0) returned 0x2 [0119.065] RegSetValueExW (in: hKey=0x3b0, lpValueName="NoControlPanel", Reserved=0x0, dwType=0x1, lpData="1", cbData=0x4 | out: lpData="1") returned 0x0 [0119.065] RegCloseKey (hKey=0x3b0) returned 0x0 [0119.065] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x3b0) returned 0x0 [0119.065] RegQueryValueExW (in: hKey=0x3b0, lpValueName="HideClock", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x0, lpData=0x0, lpcbData=0x10af3f0*=0x0) returned 0x2 [0119.065] RegSetValueExW (in: hKey=0x3b0, lpValueName="HideClock", Reserved=0x0, dwType=0x1, lpData="1", cbData=0x4 | out: lpData="1") returned 0x0 [0119.065] RegCloseKey (hKey=0x3b0) returned 0x0 [0119.066] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x3b0) returned 0x0 [0119.066] RegQueryValueExW (in: hKey=0x3b0, lpValueName="NoLogoff", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x0, lpData=0x0, lpcbData=0x10af3f0*=0x0) returned 0x2 [0119.066] RegSetValueExW (in: hKey=0x3b0, lpValueName="NoLogoff", Reserved=0x0, dwType=0x1, lpData="1", cbData=0x4 | out: lpData="1") returned 0x0 [0119.066] RegCloseKey (hKey=0x3b0) returned 0x0 [0119.066] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x3b0) returned 0x0 [0119.066] RegQueryValueExW (in: hKey=0x3b0, lpValueName="NoWindowsUpdate", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x0, lpData=0x0, lpcbData=0x10af3f0*=0x0) returned 0x2 [0119.066] RegSetValueExW (in: hKey=0x3b0, lpValueName="NoWindowsUpdate", Reserved=0x0, dwType=0x1, lpData="1", cbData=0x4 | out: lpData="1") returned 0x0 [0119.066] RegCloseKey (hKey=0x3b0) returned 0x0 [0119.066] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x3b0) returned 0x0 [0119.067] RegQueryValueExW (in: hKey=0x3b0, lpValueName="NoDrives", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x0, lpData=0x0, lpcbData=0x10af3f0*=0x0) returned 0x2 [0119.067] RegSetValueExW (in: hKey=0x3b0, lpValueName="NoDrives", Reserved=0x0, dwType=0x1, lpData="1", cbData=0x4 | out: lpData="1") returned 0x0 [0119.067] RegCloseKey (hKey=0x3b0) returned 0x0 [0119.067] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey="txtfile\\DefaultIcon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x21a) returned 0x0 [0119.067] RegQueryValueExW (in: hKey=0x21a, lpValueName="", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x2, lpData=0x0, lpcbData=0x10af3f0*=0x50) returned 0x0 [0119.067] RegSetValueExW (in: hKey=0x21a, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\WinWOW32\\\\icon.ico", cbData=0x2c | out: lpData="C:\\WinWOW32\\\\icon.ico") returned 0x0 [0119.067] RegCloseKey (hKey=0x21a) returned 0x0 [0119.067] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey="exefile\\DefaultIcon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x21a) returned 0x0 [0119.067] RegQueryValueExW (in: hKey=0x21a, lpValueName="", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x1, lpData=0x0, lpcbData=0x10af3f0*=0x6) returned 0x0 [0119.067] RegSetValueExW (in: hKey=0x21a, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\WinWOW32\\\\icon.ico", cbData=0x2c | out: lpData="C:\\WinWOW32\\\\icon.ico") returned 0x0 [0119.068] RegCloseKey (hKey=0x21a) returned 0x0 [0119.068] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey="VBSFile\\DefaultIcon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x21a) returned 0x0 [0119.068] RegQueryValueExW (in: hKey=0x21a, lpValueName="", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x2, lpData=0x0, lpcbData=0x10af3f0*=0x48) returned 0x0 [0119.068] RegSetValueExW (in: hKey=0x21a, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\WinWOW32\\\\icon.ico", cbData=0x2c | out: lpData="C:\\WinWOW32\\\\icon.ico") returned 0x0 [0119.068] RegCloseKey (hKey=0x21a) returned 0x0 [0119.068] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey="batfile\\DefaultIcon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x21a) returned 0x0 [0119.068] RegQueryValueExW (in: hKey=0x21a, lpValueName="", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x2, lpData=0x0, lpcbData=0x10af3f0*=0x4e) returned 0x0 [0119.068] RegSetValueExW (in: hKey=0x21a, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\WinWOW32\\\\icon.ico", cbData=0x2c | out: lpData="C:\\WinWOW32\\\\icon.ico") returned 0x0 [0119.068] RegCloseKey (hKey=0x21a) returned 0x0 [0119.068] RegOpenKeyExW (in: hKey=0x80000000, lpSubKey="dllfile\\DefaultIcon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x21a) returned 0x0 [0119.068] RegQueryValueExW (in: hKey=0x21a, lpValueName="", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x1, lpData=0x0, lpcbData=0x10af3f0*=0x4a) returned 0x0 [0119.069] RegSetValueExW (in: hKey=0x21a, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\WinWOW32\\\\icon.ico", cbData=0x2c | out: lpData="C:\\WinWOW32\\\\icon.ico") returned 0x0 [0119.069] RegCloseKey (hKey=0x21a) returned 0x0 [0119.069] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x218) returned 0x0 [0119.069] RegQueryValueExW (in: hKey=0x218, lpValueName="AutoRestartShell", lpReserved=0x0, lpType=0x10af3fc, lpData=0x0, lpcbData=0x10af3f8*=0x0 | out: lpType=0x10af3fc*=0x0, lpData=0x0, lpcbData=0x10af3f8*=0x0) returned 0x2 [0119.070] RegSetValueExW (in: hKey=0x218, lpValueName="AutoRestartShell", Reserved=0x0, dwType=0x4, lpData=0x10af418*=0x0, cbData=0x4 | out: lpData=0x10af418*=0x0) returned 0x0 [0119.070] RegCloseKey (hKey=0x218) returned 0x0 [0119.070] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x218) returned 0x0 [0119.070] RegQueryValueExW (in: hKey=0x218, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x10af3fc, lpData=0x0, lpcbData=0x10af3f8*=0x0 | out: lpType=0x10af3fc*=0x4, lpData=0x0, lpcbData=0x10af3f8*=0x4) returned 0x0 [0119.070] RegSetValueExW (in: hKey=0x218, lpValueName="EnableLUA", Reserved=0x0, dwType=0x4, lpData=0x10af418*=0x0, cbData=0x4 | out: lpData=0x10af418*=0x0) returned 0x0 [0119.084] RegCloseKey (hKey=0x218) returned 0x0 [0119.084] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows Defender", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x218) returned 0x0 [0119.084] RegQueryValueExW (in: hKey=0x218, lpValueName="DisableAntiSpyware", lpReserved=0x0, lpType=0x10af3fc, lpData=0x0, lpcbData=0x10af3f8*=0x0 | out: lpType=0x10af3fc*=0x4, lpData=0x0, lpcbData=0x10af3f8*=0x4) returned 0x0 [0119.084] RegSetValueExW (in: hKey=0x218, lpValueName="DisableAntiSpyware", Reserved=0x0, dwType=0x4, lpData=0x10af418*=0x1, cbData=0x4 | out: lpData=0x10af418*=0x1) returned 0x0 [0119.084] RegCloseKey (hKey=0x218) returned 0x0 [0119.092] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x218) returned 0x0 [0119.092] RegQueryValueExW (in: hKey=0x218, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x10af3fc, lpData=0x0, lpcbData=0x10af3f8*=0x0 | out: lpType=0x10af3fc*=0x4, lpData=0x0, lpcbData=0x10af3f8*=0x4) returned 0x0 [0119.092] RegSetValueExW (in: hKey=0x218, lpValueName="ConsentPromptBehaviorAdmin", Reserved=0x0, dwType=0x4, lpData=0x10af418*=0x0, cbData=0x4 | out: lpData=0x10af418*=0x0) returned 0x0 [0119.093] RegCloseKey (hKey=0x218) returned 0x0 [0119.094] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\MobilityCenter", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x0) returned 0x2 [0119.094] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\MobilityCenter", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x10af3a0, lpdwDisposition=0x10af428 | out: phkResult=0x10af3a0*=0x218, lpdwDisposition=0x10af428*=0x1) returned 0x0 [0119.094] RegQueryValueExW (in: hKey=0x218, lpValueName="NoMobilityCenter", lpReserved=0x0, lpType=0x10af3fc, lpData=0x0, lpcbData=0x10af3f8*=0x0 | out: lpType=0x10af3fc*=0x0, lpData=0x0, lpcbData=0x10af3f8*=0x0) returned 0x2 [0119.094] RegSetValueExW (in: hKey=0x218, lpValueName="NoMobilityCenter", Reserved=0x0, dwType=0x4, lpData=0x10af418*=0x1, cbData=0x4 | out: lpData=0x10af418*=0x1) returned 0x0 [0119.094] RegCloseKey (hKey=0x218) returned 0x0 [0119.094] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x218) returned 0x0 [0119.094] RegQueryValueExW (in: hKey=0x218, lpValueName="NoFolderOptions", lpReserved=0x0, lpType=0x10af3fc, lpData=0x0, lpcbData=0x10af3f8*=0x0 | out: lpType=0x10af3fc*=0x0, lpData=0x0, lpcbData=0x10af3f8*=0x0) returned 0x2 [0119.094] RegSetValueExW (in: hKey=0x218, lpValueName="NoFolderOptions", Reserved=0x0, dwType=0x4, lpData=0x10af418*=0x1, cbData=0x4 | out: lpData=0x10af418*=0x1) returned 0x0 [0119.094] RegCloseKey (hKey=0x218) returned 0x0 [0119.094] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x218) returned 0x0 [0119.094] RegQueryValueExW (in: hKey=0x218, lpValueName="Hidden", lpReserved=0x0, lpType=0x10af3fc, lpData=0x0, lpcbData=0x10af3f8*=0x0 | out: lpType=0x10af3fc*=0x4, lpData=0x0, lpcbData=0x10af3f8*=0x4) returned 0x0 [0119.094] RegSetValueExW (in: hKey=0x218, lpValueName="Hidden", Reserved=0x0, dwType=0x4, lpData=0x10af418*=0x2, cbData=0x4 | out: lpData=0x10af418*=0x2) returned 0x0 [0119.095] RegCloseKey (hKey=0x218) returned 0x0 [0119.095] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x218) returned 0x0 [0119.095] RegQueryValueExW (in: hKey=0x218, lpValueName="ShowSuperHidden", lpReserved=0x0, lpType=0x10af3fc, lpData=0x0, lpcbData=0x10af3f8*=0x0 | out: lpType=0x10af3fc*=0x4, lpData=0x0, lpcbData=0x10af3f8*=0x4) returned 0x0 [0119.095] RegSetValueExW (in: hKey=0x218, lpValueName="ShowSuperHidden", Reserved=0x0, dwType=0x4, lpData=0x10af418*=0x0, cbData=0x4 | out: lpData=0x10af418*=0x0) returned 0x0 [0119.095] RegCloseKey (hKey=0x218) returned 0x0 [0119.095] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x218) returned 0x0 [0119.095] RegQueryValueExW (in: hKey=0x218, lpValueName="HideFileExt", lpReserved=0x0, lpType=0x10af3fc, lpData=0x0, lpcbData=0x10af3f8*=0x0 | out: lpType=0x10af3fc*=0x4, lpData=0x0, lpcbData=0x10af3f8*=0x4) returned 0x0 [0119.095] RegSetValueExW (in: hKey=0x218, lpValueName="HideFileExt", Reserved=0x0, dwType=0x4, lpData=0x10af418*=0x1, cbData=0x4 | out: lpData=0x10af418*=0x1) returned 0x0 [0119.095] RegCloseKey (hKey=0x218) returned 0x0 [0119.095] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x218) returned 0x0 [0119.095] RegQueryValueExW (in: hKey=0x218, lpValueName="DisableRegistryTools", lpReserved=0x0, lpType=0x10af3fc, lpData=0x0, lpcbData=0x10af3f8*=0x0 | out: lpType=0x10af3fc*=0x0, lpData=0x0, lpcbData=0x10af3f8*=0x0) returned 0x2 [0119.095] RegSetValueExW (in: hKey=0x218, lpValueName="DisableRegistryTools", Reserved=0x0, dwType=0x4, lpData=0x10af418*=0x1, cbData=0x4 | out: lpData=0x10af418*=0x1) returned 0x0 [0119.096] RegCloseKey (hKey=0x218) returned 0x0 [0119.096] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x218) returned 0x0 [0119.096] RegQueryValueExW (in: hKey=0x218, lpValueName="legalnoticecaption", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x1, lpData=0x0, lpcbData=0x10af3f0*=0x2) returned 0x0 [0119.096] RegSetValueExW (in: hKey=0x218, lpValueName="legalnoticecaption", Reserved=0x0, dwType=0x1, lpData="LIGMA", cbData=0xc | out: lpData="LIGMA") returned 0x0 [0119.097] RegCloseKey (hKey=0x218) returned 0x0 [0119.097] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x10af3a4 | out: phkResult=0x10af3a4*=0x218) returned 0x0 [0119.097] RegQueryValueExW (in: hKey=0x218, lpValueName="legalnoticetext", lpReserved=0x0, lpType=0x10af3f4, lpData=0x0, lpcbData=0x10af3f0*=0x0 | out: lpType=0x10af3f4*=0x1, lpData=0x0, lpcbData=0x10af3f0*=0x4) returned 0x0 [0119.097] RegSetValueExW (in: hKey=0x218, lpValueName="legalnoticetext", Reserved=0x0, dwType=0x1, lpData="Your Computer Got FUCKED By LIGMA!", cbData=0x46 | out: lpData="Your Computer Got FUCKED By LIGMA!") returned 0x0 [0119.098] RegCloseKey (hKey=0x218) returned 0x0 [0119.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\LIGMA.exe.config", nBufferLength=0x105, lpBuffer=0x10aecd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\LIGMA.exe.config", lpFilePart=0x0) returned 0x2e [0119.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af16c) returned 1 [0119.159] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\LIGMA.exe.config" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ligma.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x10af1e8 | out: lpFileInformation=0x10af1e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0119.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af168) returned 1 [0119.260] GetFullPathNameW (in: lpFileName="C:\\WinWOW32\\work.bat", nBufferLength=0x105, lpBuffer=0x10aedfc, lpFilePart=0x0 | out: lpBuffer="C:\\WinWOW32\\work.bat", lpFilePart=0x0) returned 0x14 [0119.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2f0) returned 1 [0119.260] CreateFileW (lpFileName="C:\\WinWOW32\\work.bat" (normalized: "c:\\winwow32\\work.bat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3bc [0119.261] GetFileType (hFile=0x3bc) returned 0x1 [0119.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2ec) returned 1 [0119.261] GetFileType (hFile=0x3bc) returned 0x1 [0119.261] WriteFile (in: hFile=0x3bc, lpBuffer=0x2e75dec*, nNumberOfBytesToWrite=0x322, lpNumberOfBytesWritten=0x10af380, lpOverlapped=0x0 | out: lpBuffer=0x2e75dec*, lpNumberOfBytesWritten=0x10af380*=0x322, lpOverlapped=0x0) returned 1 [0119.262] CloseHandle (hObject=0x3bc) returned 1 [0119.265] GetFullPathNameW (in: lpFileName="C:\\WinWOW32\\icon.ico", nBufferLength=0x105, lpBuffer=0x10aedfc, lpFilePart=0x0 | out: lpBuffer="C:\\WinWOW32\\icon.ico", lpFilePart=0x0) returned 0x14 [0119.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2f0) returned 1 [0119.265] CreateFileW (lpFileName="C:\\WinWOW32\\icon.ico" (normalized: "c:\\winwow32\\icon.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3bc [0119.265] GetFileType (hFile=0x3bc) returned 0x1 [0119.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2ec) returned 1 [0119.266] GetFileType (hFile=0x3bc) returned 0x1 [0119.266] WriteFile (in: hFile=0x3bc, lpBuffer=0x2e76e48*, nNumberOfBytesToWrite=0x1e07, lpNumberOfBytesWritten=0x10af3ac, lpOverlapped=0x0 | out: lpBuffer=0x2e76e48*, lpNumberOfBytesWritten=0x10af3ac*=0x1e07, lpOverlapped=0x0) returned 1 [0119.266] CloseHandle (hObject=0x3bc) returned 1 [0119.268] GetFullPathNameW (in: lpFileName="C:\\WinWOW32\\Payloads.dll", nBufferLength=0x105, lpBuffer=0x10aedfc, lpFilePart=0x0 | out: lpBuffer="C:\\WinWOW32\\Payloads.dll", lpFilePart=0x0) returned 0x18 [0119.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2f0) returned 1 [0119.269] CreateFileW (lpFileName="C:\\WinWOW32\\Payloads.dll" (normalized: "c:\\winwow32\\payloads.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3bc [0119.269] GetFileType (hFile=0x3bc) returned 0x1 [0119.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2ec) returned 1 [0119.269] GetFileType (hFile=0x3bc) returned 0x1 [0119.269] WriteFile (in: hFile=0x3bc, lpBuffer=0x2e78d70*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x10af3ac, lpOverlapped=0x0 | out: lpBuffer=0x2e78d70*, lpNumberOfBytesWritten=0x10af3ac*=0x3800, lpOverlapped=0x0) returned 1 [0119.270] CloseHandle (hObject=0x3bc) returned 1 [0119.272] GetFullPathNameW (in: lpFileName="C:\\WinWOW32\\mbr.bin", nBufferLength=0x105, lpBuffer=0x10aedfc, lpFilePart=0x0 | out: lpBuffer="C:\\WinWOW32\\mbr.bin", lpFilePart=0x0) returned 0x13 [0119.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2f0) returned 1 [0119.272] CreateFileW (lpFileName="C:\\WinWOW32\\mbr.bin" (normalized: "c:\\winwow32\\mbr.bin"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3bc [0119.274] GetFileType (hFile=0x3bc) returned 0x1 [0119.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x10af2ec) returned 1 [0119.274] GetFileType (hFile=0x3bc) returned 0x1 [0119.274] WriteFile (in: hFile=0x3bc, lpBuffer=0x2e7ca04*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x10af380, lpOverlapped=0x0 | out: lpBuffer=0x2e7ca04*, lpNumberOfBytesWritten=0x10af380*=0x200, lpOverlapped=0x0) returned 1 [0119.275] CloseHandle (hObject=0x3bc) returned 1 [0119.347] CoTaskMemAlloc (cb=0x20e) returned 0x146f948 [0119.347] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x146f948 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0119.347] CoTaskMemFree (pv=0x146f948) [0119.347] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\WinWOW32\\\\work.bat\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpStartupInfo=0x10af258*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2e7dc94 | out: lpCommandLine="\"C:\\WinWOW32\\\\work.bat\"", lpProcessInformation=0x2e7dc94*(hProcess=0x3c4, hThread=0x3bc, dwProcessId=0xdf4, dwThreadId=0xdfc)) returned 1 [0119.571] CloseHandle (hObject=0x3bc) returned 1 [0119.633] SleepEx (dwMilliseconds=0xafc8, bAlertable=1) returned 0x0 [0129.773] SleepEx (dwMilliseconds=0x3a98, bAlertable=1) returned 0x0 [0139.937] SleepEx (dwMilliseconds=0x3a98, bAlertable=1) Thread: id = 2 os_tid = 0x1a0 Thread: id = 3 os_tid = 0xa44 Thread: id = 4 os_tid = 0x8cc [0036.239] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0036.239] RoInitialize () returned 0x1 [0036.239] RoUninitialize () returned 0x0 [0122.598] CloseHandle (hObject=0x3c4) returned 1 Thread: id = 5 os_tid = 0x848 Thread: id = 6 os_tid = 0xcfc [0111.097] SleepEx (dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0136.664] CoGetContextToken (in: pToken=0xb26f6ec | out: pToken=0xb26f6ec) returned 0x0 [0136.664] CObjectContext::QueryInterface () returned 0x0 [0136.664] CObjectContext::GetCurrentThreadType () returned 0x0 [0136.664] Release () returned 0x0 Thread: id = 7 os_tid = 0xdac Thread: id = 8 os_tid = 0xd90 Thread: id = 10 os_tid = 0xd50 [0119.609] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0119.609] RoInitialize () returned 0x1 [0119.609] RoUninitialize () returned 0x0 [0121.389] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xb56eb44 | out: lpLuid=0xb56eb44*(LowPart=0x14, HighPart=0)) returned 1 [0121.389] GetCurrentProcess () returned 0xffffffff [0121.390] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0xb56eb40 | out: TokenHandle=0xb56eb40*=0x3f8) returned 1 [0121.390] AdjustTokenPrivileges (in: TokenHandle=0x3f8, DisableAllPrivileges=0, NewState=0x2e7e5c0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0121.390] CloseHandle (hObject=0x3f8) returned 1 [0122.494] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf740) returned 0x0 [0122.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.563] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf700) returned 0x0 [0122.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.608] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.608] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.610] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.610] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.611] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.611] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf780) returned 0x0 [0122.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.628] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.628] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.629] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.629] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.630] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.630] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.631] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.632] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.632] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.633] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.634] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.634] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.635] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.635] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.636] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.640] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.640] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.641] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.642] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.642] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.643] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.643] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.645] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.645] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.646] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.647] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.647] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.648] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.648] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.650] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.651] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.655] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.656] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.656] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.658] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.658] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.659] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.660] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.660] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.661] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.661] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.662] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.662] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.663] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.663] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.707] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.710] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.710] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.711] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.713] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.713] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.718] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.718] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.719] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.719] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.720] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.720] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.749] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.772] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.772] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.780] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.780] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.781] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.781] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.782] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.782] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.815] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.819] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.820] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.820] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.821] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.822] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.822] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.847] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.849] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.849] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.857] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.857] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.857] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.862] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.862] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.864] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.864] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.865] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.865] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.866] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.867] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.867] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.868] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.869] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.870] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.870] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.872] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.876] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.876] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.878] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0122.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.894] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.894] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.895] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.900] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.901] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.901] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.906] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.906] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.907] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.907] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.908] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.908] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.947] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.947] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.948] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.950] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.950] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.951] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.951] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.952] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.952] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.953] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.953] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.954] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.954] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.955] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.957] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.957] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.957] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.957] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf800) returned 0x0 [0122.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.967] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.967] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.967] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.990] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.990] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.990] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.990] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.991] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.991] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.992] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.993] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.993] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.993] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.993] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.994] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.994] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.994] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.995] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.995] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.995] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.995] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.996] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.996] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.996] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0122.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.010] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.010] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf840) returned 0x0 [0123.036] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.089] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.091] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.092] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.092] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.092] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.092] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.093] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.093] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.093] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.093] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.094] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.094] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.094] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.094] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.095] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.095] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.095] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.095] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.099] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.099] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0123.099] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf880) returned 0x0 [0124.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.448] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.448] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.449] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.449] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.450] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.453] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.463] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.464] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.518] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.519] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.519] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.520] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.520] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.520] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.521] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.521] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.521] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.521] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.522] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.522] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.522] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.523] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.523] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.523] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.523] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.524] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.524] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.524] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.525] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.531] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.531] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.532] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.532] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.544] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.545] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.545] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.545] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.545] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.547] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.547] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.547] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.556] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.556] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.559] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.559] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.563] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.599] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.599] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.599] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfac0) returned 0x0 [0124.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.846] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb80) returned 0x0 [0124.859] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.860] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.860] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.862] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.862] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.864] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.864] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.865] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.865] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.866] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.867] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.867] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.868] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.868] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.869] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.872] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.872] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.872] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.873] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.873] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.873] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.873] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.875] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.875] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.875] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.875] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.876] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.876] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.876] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.878] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.878] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.885] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.885] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.885] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.886] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.886] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.886] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.886] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.891] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.907] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.907] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.908] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.908] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.908] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.909] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.909] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.909] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.910] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.910] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.910] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.911] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.944] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.952] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.953] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.955] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.957] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.967] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.967] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.967] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.967] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.977] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0124.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.010] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.010] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.085] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.085] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.086] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.086] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.087] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.088] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.088] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.089] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.089] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.091] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.092] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.092] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.093] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.105] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.105] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.105] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.108] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.108] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.108] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.111] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.111] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.112] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.112] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.112] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.113] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.113] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.113] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.115] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.115] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.115] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.116] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.116] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.116] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.116] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.117] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.117] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.119] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.122] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.122] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.123] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.123] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.123] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.125] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.125] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.134] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.134] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.136] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.138] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.138] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.138] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.154] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.154] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.154] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.155] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.156] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.156] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.156] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.156] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.159] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.159] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.159] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.160] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.160] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.160] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.164] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.164] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.164] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.164] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.169] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.169] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.169] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.174] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.174] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.174] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.175] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.214] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.214] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.214] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.214] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.217] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.217] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.218] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.218] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.218] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.219] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.219] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.219] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.220] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.220] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.220] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.220] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.221] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.221] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0125.494] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.494] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.494] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.495] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.495] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.495] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.525] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.525] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.531] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.532] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.532] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.532] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.544] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.544] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.545] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.547] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.547] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.547] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.547] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.556] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.556] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.556] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.566] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.610] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.611] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.611] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.614] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.615] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.616] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.617] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.618] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.619] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.623] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.625] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.954] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.955] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.957] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.967] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.977] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.977] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.977] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfdb8) returned 0x0 [0125.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.990] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.990] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.991] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.991] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.992] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.992] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.994] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.995] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.996] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.996] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0125.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.010] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.027] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.028] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.028] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.029] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.029] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.029] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.030] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.030] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.030] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.030] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.033] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.033] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.034] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.035] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.036] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.036] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.036] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.046] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.046] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.046] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0126.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.184] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.184] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.206] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.206] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.206] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.207] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.207] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.207] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.208] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.208] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.208] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.209] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.215] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.218] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.218] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.218] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.218] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.219] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.219] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.219] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.219] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.220] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.220] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.220] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.221] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.221] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.221] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.221] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.222] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.222] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.222] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.223] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.224] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.224] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.224] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.225] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.225] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.225] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.226] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.226] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.226] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.226] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.231] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.231] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.231] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.231] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.237] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.237] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.238] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.238] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.238] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.239] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.239] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.239] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.240] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.240] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.240] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.242] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.243] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.243] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.243] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.244] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.244] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.244] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.244] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.263] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.263] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.263] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.265] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.265] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.265] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.266] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.266] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.363] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.363] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.363] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.378] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.378] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.378] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.379] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.379] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.379] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.380] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.381] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.381] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.381] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.381] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.382] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.382] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.382] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.383] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.383] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.383] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.383] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.384] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.384] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.384] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.385] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.385] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.385] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.387] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.387] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.387] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.389] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.389] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.389] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.391] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.397] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.397] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.401] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.401] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.401] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.402] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.402] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.402] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.405] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.405] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.406] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.407] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.407] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.408] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.408] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.409] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.409] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.409] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.410] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.410] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.410] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.411] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.411] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.411] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.411] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.412] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.412] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.412] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.413] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.414] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.414] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.414] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.415] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.415] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.415] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.418] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.418] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.426] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.426] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.427] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.427] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.429] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.429] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.429] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.429] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.436] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.437] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.438] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.439] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.443] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.444] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.444] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.445] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.448] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.449] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.450] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.453] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.464] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.473] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.473] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.473] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.476] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.476] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.477] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.477] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.477] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.478] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.478] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.479] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.479] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.479] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.480] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.480] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.484] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.656] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.656] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.658] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.659] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.659] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.660] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.661] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.661] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.662] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.663] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.663] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.664] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.664] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.665] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.666] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.667] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.671] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.672] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.673] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.673] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.673] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.674] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.674] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.674] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.674] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.675] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.675] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.675] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.676] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.676] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.676] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.676] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.677] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.701] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.701] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.701] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.707] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.707] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.710] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.710] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.710] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.710] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.711] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.711] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.713] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.713] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.713] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.713] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.714] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.714] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.714] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.716] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.716] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.716] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.717] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.717] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.717] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.719] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.719] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.719] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.720] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.720] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.720] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.720] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.732] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.749] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbc0) returned 0x0 [0126.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.990] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.991] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.992] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.996] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0126.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.027] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.027] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.028] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.028] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.029] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.029] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.029] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.030] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.033] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.033] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.033] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.034] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.034] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.034] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.035] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.035] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.035] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.036] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.040] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.046] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.063] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.063] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.063] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.065] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.065] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.066] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.067] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.067] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.067] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.068] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.068] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.069] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.069] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.069] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.070] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.070] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.070] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.070] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.071] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.071] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.071] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.073] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.077] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.078] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.078] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.079] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.079] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.079] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.081] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.081] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.081] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.081] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.085] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.086] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.086] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.087] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.088] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.088] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.091] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.091] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.092] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.125] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.130] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.130] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.131] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.131] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.131] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.132] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.132] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.132] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.132] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.134] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.134] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.134] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.136] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.136] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.142] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.143] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.143] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.143] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.143] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.144] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.144] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.144] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd38) returned 0x0 [0127.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.379] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.380] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.380] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.380] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.380] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.381] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.381] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.381] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.382] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.382] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.382] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.382] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.383] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.383] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.383] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.383] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.385] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.385] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.385] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.385] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.387] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.387] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.387] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.389] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.389] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.391] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.391] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.392] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.392] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.392] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.393] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.393] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.399] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.399] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.401] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.401] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.401] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.401] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.405] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.405] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.405] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.406] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.406] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.406] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.407] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.407] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.418] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.418] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.427] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.435] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.436] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.436] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.436] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.437] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.437] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.437] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.437] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.438] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.438] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.438] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.439] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.439] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.439] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.440] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.440] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.440] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.443] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.444] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.445] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.445] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.445] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.448] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.448] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.448] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.449] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.449] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.450] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.450] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.453] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.453] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.470] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.471] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.487] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.487] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.487] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.487] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.488] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.488] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.488] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.488] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.493] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfd78) returned 0x0 [0127.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.732] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.732] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.737] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.737] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.749] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.749] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.772] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.773] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.773] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.774] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.775] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.793] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.793] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.793] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.807] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.807] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.807] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.807] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.810] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.814] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.816] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.816] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.817] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.817] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.817] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.817] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.819] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.820] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.820] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.821] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.821] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.821] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.822] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.822] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.822] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.846] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.846] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.849] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.857] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.857] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.857] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.858] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.858] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.858] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.858] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.859] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.859] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.859] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.860] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.957] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.957] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.971] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.972] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.977] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.978] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.991] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.991] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.992] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.992] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.992] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.992] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.993] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.994] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.994] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.994] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.995] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0127.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.010] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.029] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.029] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.030] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.030] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.030] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.033] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.034] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.034] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.034] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.035] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.035] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.035] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.036] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.036] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.036] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.036] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.040] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.046] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.046] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.063] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.063] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.063] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfb40) returned 0x0 [0128.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.253] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.254] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.255] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.263] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.263] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.263] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.265] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.266] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.266] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfcf8) returned 0x0 [0128.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.311] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.313] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.313] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.313] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.314] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.314] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.314] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.316] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.318] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.332] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.332] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.333] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.333] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.337] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.338] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.338] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.348] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.348] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.363] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.363] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.363] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.366] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.366] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.380] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.381] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.381] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.382] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.382] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.383] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.383] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.384] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.385] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.387] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.389] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.389] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.389] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.390] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.391] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.391] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.391] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.392] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.392] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.392] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.392] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.393] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.394] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.394] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.394] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.395] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.395] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.395] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.395] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.396] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.396] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.396] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.397] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.397] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.397] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfc38) returned 0x0 [0128.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.965] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.966] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.967] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.967] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.968] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0128.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xfbf8) returned 0x0 [0129.522] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.522] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.522] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.523] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.523] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.523] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.524] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.524] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.524] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.524] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.525] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.525] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.525] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.525] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.531] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.531] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.531] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.531] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.532] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.532] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.544] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.544] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.545] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.545] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.545] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.545] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.547] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.547] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.547] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.556] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.556] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.556] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.556] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.559] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.559] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.559] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.563] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.563] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.563] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.563] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.565] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.567] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0129.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf7c0) returned 0x0 [0130.285] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.285] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.286] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.286] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.286] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.286] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.287] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.287] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.287] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.289] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.289] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.289] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.289] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.290] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.290] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.292] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.292] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.292] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.292] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.293] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.293] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.293] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.293] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.294] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.294] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.295] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.295] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.296] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.296] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.296] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.296] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.297] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.306] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.306] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.306] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.306] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.311] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.311] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.311] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.311] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.312] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.312] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.312] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.313] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.313] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.313] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.313] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.314] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.314] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.316] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.316] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.316] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.316] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.317] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.317] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.317] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.317] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.318] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.318] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.318] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.318] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.320] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.320] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.330] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.332] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.332] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.333] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.333] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.333] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.337] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.337] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.337] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.344] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.344] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.344] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.344] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.345] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.346] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.346] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.346] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.347] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.347] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.347] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.347] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.348] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.348] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.348] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0130.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf340) returned 0x0 [0132.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.793] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0132.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf1c0) returned 0x0 [0134.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.860] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.862] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.865] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.866] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.867] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.868] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.868] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.869] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.870] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.870] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.872] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.873] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.873] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.874] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.875] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.875] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.876] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.876] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.878] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.885] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.885] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.885] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.885] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.886] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.886] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.886] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.886] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.890] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.890] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.890] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.891] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.891] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.891] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.891] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.894] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.894] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.894] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.894] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.895] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.896] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.896] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.896] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.898] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.898] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.898] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.898] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.900] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.900] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.900] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.900] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.901] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.906] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.906] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.907] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.907] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.907] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.908] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.908] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.908] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.908] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.929] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.944] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.944] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.944] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.944] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.947] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.948] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0134.948] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf180) returned 0x0 [0136.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.718] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.718] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.719] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.719] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.719] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.720] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.720] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.732] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.737] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.737] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.737] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.749] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.772] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.780] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.780] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.780] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.780] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.781] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.782] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.782] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.782] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.782] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0136.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xf000) returned 0x0 [0141.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.700] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.701] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.701] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.706] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.707] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.707] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.707] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.710] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.710] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.711] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.711] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.713] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.713] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.713] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.713] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.714] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.714] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.714] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.714] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.716] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.716] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.732] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.733] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.735] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.737] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.737] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.747] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.749] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.749] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 [0141.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3ea9180, Length=0x20000, ResultLength=0xb56f220 | out: SystemInformation=0x3ea9180, ResultLength=0xb56f220*=0xe940) returned 0x0 Thread: id = 12 os_tid = 0xd4c [0119.629] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0119.629] RoInitialize () returned 0x1 [0119.629] RoUninitialize () returned 0x0 [0122.491] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0122.491] _initialize_onexit_table (_Table=0x731853e4) returned 0 [0122.491] _initialize_onexit_table (_Table=0x731853f0) returned 0 [0122.491] RtlInitializeSListHead (in: ListHead=0x731853c0 | out: ListHead=0x731853c0) [0122.491] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0122.497] CreateFileW (lpFileName="\\\\.\\PhysicalDrive0" (normalized: "\\device\\harddisk0\\dr0"), dwDesiredAccess=0x10000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0122.498] CreateFileW (lpFileName="C:\\WinWOW32\\mbr.bin" (normalized: "c:\\winwow32\\mbr.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.498] GetFileSize (in: hFile=0x3fc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200 [0122.498] ReadFile (in: hFile=0x3fc, lpBuffer=0x14de970, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0xb66f144, lpOverlapped=0x0 | out: lpBuffer=0x14de970*, lpNumberOfBytesRead=0xb66f144*=0x200, lpOverlapped=0x0) returned 1 [0122.498] WriteFile (in: hFile=0x3f8, lpBuffer=0x14de970*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0xb66f144, lpOverlapped=0x0 | out: lpBuffer=0x14de970*, lpNumberOfBytesWritten=0xb66f144*=0x200, lpOverlapped=0x0) returned 1 [0122.499] CloseHandle (hObject=0x3f8) returned 1 [0122.499] CoUninitialize () Thread: id = 14 os_tid = 0xed4 Thread: id = 23 os_tid = 0xc8c [0129.684] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0129.684] RoInitialize () returned 0x1 [0129.684] RoUninitialize () returned 0x0 [0129.771] GetDesktopWindow () returned 0x10010 [0129.771] GetWindowDC (hWnd=0x10010) returned 0x10105e0 [0129.771] CreateCompatibleDC (hdc=0x10105e0) returned 0xf01063b [0129.771] GetWindowRect (in: hWnd=0x10010, lpRect=0xb66f6e8 | out: lpRect=0xb66f6e8) returned 1 [0129.771] GetCursorPos (in: lpPoint=0xb66f6e0 | out: lpPoint=0xb66f6e0*(x=535, y=873)) returned 1 [0129.771] GetSystemMetrics (nIndex=11) returned 32 [0129.771] GetSystemMetrics (nIndex=12) returned 32 [0129.771] SetBkColor (hdc=0x10105e0, color=0x1) returned 0xffffff [0129.771] CreateCompatibleBitmap (hdc=0x10105e0, cx=1440, cy=900) returned 0xb050747 [0129.773] SelectObject (hdc=0xf01063b, h=0xb050747) returned 0x185000f [0129.773] BitBlt (hdc=0xf01063b, x=0, y=0, cx=1440, cy=900, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0129.916] BitBlt (hdc=0x10105e0, x=0, y=10, cx=1440, cy=890, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0130.043] BitBlt (hdc=0x10105e0, x=0, y=0, cx=0, cy=900, hdcSrc=0xf01063b, x1=0, y1=0, rop=0xcc0020) returned 1 [0130.043] BitBlt (hdc=0x10105e0, x=0, y=0, cx=1440, cy=10, hdcSrc=0xf01063b, x1=0, y1=890, rop=0xcc0020) returned 1 [0130.043] DeleteDC (hdc=0x10105e0) returned 1 [0130.043] DeleteDC (hdc=0xf01063b) returned 1 [0130.043] DeleteObject (ho=0xb050747) returned 1 [0130.043] Sleep (dwMilliseconds=0x3e8) [0131.078] GetDesktopWindow () returned 0x10010 [0131.078] GetWindowDC (hWnd=0x10010) returned 0x10105e0 [0131.078] CreateCompatibleDC (hdc=0x10105e0) returned 0x1101063b [0131.078] GetWindowRect (in: hWnd=0x10010, lpRect=0xb66f6e8 | out: lpRect=0xb66f6e8) returned 1 [0131.079] GetCursorPos (in: lpPoint=0xb66f6e0 | out: lpPoint=0xb66f6e0*(x=830, y=558)) returned 1 [0131.079] GetSystemMetrics (nIndex=11) returned 32 [0131.079] GetSystemMetrics (nIndex=12) returned 32 [0131.079] SetBkColor (hdc=0x10105e0, color=0x1) returned 0xffffff [0131.079] CreateCompatibleBitmap (hdc=0x10105e0, cx=1440, cy=900) returned 0xd050747 [0131.080] SelectObject (hdc=0x1101063b, h=0xd050747) returned 0x185000f [0131.080] BitBlt (hdc=0x1101063b, x=0, y=0, cx=1440, cy=900, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0131.234] BitBlt (hdc=0x10105e0, x=0, y=10, cx=1440, cy=890, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0131.351] BitBlt (hdc=0x10105e0, x=0, y=0, cx=0, cy=900, hdcSrc=0x1101063b, x1=0, y1=0, rop=0xcc0020) returned 1 [0131.351] BitBlt (hdc=0x10105e0, x=0, y=0, cx=1440, cy=10, hdcSrc=0x1101063b, x1=0, y1=890, rop=0xcc0020) returned 1 [0131.352] DeleteDC (hdc=0x10105e0) returned 1 [0131.352] DeleteDC (hdc=0x1101063b) returned 1 [0131.352] DeleteObject (ho=0xd050747) returned 1 [0131.352] Sleep (dwMilliseconds=0x3e8) [0132.373] GetDesktopWindow () returned 0x10010 [0132.373] GetWindowDC (hWnd=0x10010) returned 0x10105e0 [0132.373] CreateCompatibleDC (hdc=0x10105e0) returned 0x4d01074e [0132.373] GetWindowRect (in: hWnd=0x10010, lpRect=0xb66f6e8 | out: lpRect=0xb66f6e8) returned 1 [0132.373] GetCursorPos (in: lpPoint=0xb66f6e0 | out: lpPoint=0xb66f6e0*(x=830, y=558)) returned 1 [0132.373] GetSystemMetrics (nIndex=11) returned 32 [0132.373] GetSystemMetrics (nIndex=12) returned 32 [0132.373] SetBkColor (hdc=0x10105e0, color=0x1) returned 0xffffff [0132.373] CreateCompatibleBitmap (hdc=0x10105e0, cx=1440, cy=900) returned 0x40050730 [0132.378] SelectObject (hdc=0x4d01074e, h=0x40050730) returned 0x185000f [0132.378] BitBlt (hdc=0x4d01074e, x=0, y=0, cx=1440, cy=900, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0132.546] BitBlt (hdc=0x10105e0, x=0, y=10, cx=1440, cy=890, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0132.727] BitBlt (hdc=0x10105e0, x=0, y=0, cx=0, cy=900, hdcSrc=0x4d01074e, x1=0, y1=0, rop=0xcc0020) returned 1 [0132.727] BitBlt (hdc=0x10105e0, x=0, y=0, cx=1440, cy=10, hdcSrc=0x4d01074e, x1=0, y1=890, rop=0xcc0020) returned 1 [0132.727] DeleteDC (hdc=0x10105e0) returned 1 [0132.727] DeleteDC (hdc=0x4d01074e) returned 1 [0132.727] DeleteObject (ho=0x40050730) returned 1 [0132.728] Sleep (dwMilliseconds=0x3e8) [0133.748] GetDesktopWindow () returned 0x10010 [0133.748] GetWindowDC (hWnd=0x10010) returned 0x10105e0 [0133.748] CreateCompatibleDC (hdc=0x10105e0) returned 0x4f01074e [0133.748] GetWindowRect (in: hWnd=0x10010, lpRect=0xb66f6e8 | out: lpRect=0xb66f6e8) returned 1 [0133.748] GetCursorPos (in: lpPoint=0xb66f6e0 | out: lpPoint=0xb66f6e0*(x=830, y=558)) returned 1 [0133.748] GetSystemMetrics (nIndex=11) returned 32 [0133.748] GetSystemMetrics (nIndex=12) returned 32 [0133.748] SetBkColor (hdc=0x10105e0, color=0x1) returned 0xffffff [0133.748] CreateCompatibleBitmap (hdc=0x10105e0, cx=1440, cy=900) returned 0x42050730 [0133.754] SelectObject (hdc=0x4f01074e, h=0x42050730) returned 0x185000f [0133.754] BitBlt (hdc=0x4f01074e, x=0, y=0, cx=1440, cy=900, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0133.870] BitBlt (hdc=0x10105e0, x=0, y=10, cx=1440, cy=890, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0133.999] BitBlt (hdc=0x10105e0, x=0, y=0, cx=0, cy=900, hdcSrc=0x4f01074e, x1=0, y1=0, rop=0xcc0020) returned 1 [0133.999] BitBlt (hdc=0x10105e0, x=0, y=0, cx=1440, cy=10, hdcSrc=0x4f01074e, x1=0, y1=890, rop=0xcc0020) returned 1 [0133.999] DeleteDC (hdc=0x10105e0) returned 1 [0133.999] DeleteDC (hdc=0x4f01074e) returned 1 [0133.999] DeleteObject (ho=0x42050730) returned 1 [0133.999] Sleep (dwMilliseconds=0x3e8) [0135.003] GetDesktopWindow () returned 0x10010 [0135.003] GetWindowDC (hWnd=0x10010) returned 0x10105e0 [0135.003] CreateCompatibleDC (hdc=0x10105e0) returned 0x5101074e [0135.003] GetWindowRect (in: hWnd=0x10010, lpRect=0xb66f6e8 | out: lpRect=0xb66f6e8) returned 1 [0135.003] GetCursorPos (in: lpPoint=0xb66f6e0 | out: lpPoint=0xb66f6e0*(x=830, y=558)) returned 1 [0135.003] GetSystemMetrics (nIndex=11) returned 32 [0135.003] GetSystemMetrics (nIndex=12) returned 32 [0135.003] SetBkColor (hdc=0x10105e0, color=0x1) returned 0xffffff [0135.003] CreateCompatibleBitmap (hdc=0x10105e0, cx=1440, cy=900) returned 0x44050730 [0135.010] SelectObject (hdc=0x5101074e, h=0x44050730) returned 0x185000f [0135.010] BitBlt (hdc=0x5101074e, x=0, y=0, cx=1440, cy=900, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0135.124] BitBlt (hdc=0x10105e0, x=0, y=10, cx=1440, cy=890, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0135.277] BitBlt (hdc=0x10105e0, x=0, y=0, cx=0, cy=900, hdcSrc=0x5101074e, x1=0, y1=0, rop=0xcc0020) returned 1 [0135.277] BitBlt (hdc=0x10105e0, x=0, y=0, cx=1440, cy=10, hdcSrc=0x5101074e, x1=0, y1=890, rop=0xcc0020) returned 1 [0135.277] DeleteDC (hdc=0x10105e0) returned 1 [0135.277] DeleteDC (hdc=0x5101074e) returned 1 [0135.277] DeleteObject (ho=0x44050730) returned 1 [0135.277] Sleep (dwMilliseconds=0x3e8) [0136.289] GetDesktopWindow () returned 0x10010 [0136.289] GetWindowDC (hWnd=0x10010) returned 0x10105e0 [0136.289] CreateCompatibleDC (hdc=0x10105e0) returned 0x5301074e [0136.289] GetWindowRect (in: hWnd=0x10010, lpRect=0xb66f6e8 | out: lpRect=0xb66f6e8) returned 1 [0136.289] GetCursorPos (in: lpPoint=0xb66f6e0 | out: lpPoint=0xb66f6e0*(x=830, y=558)) returned 1 [0136.289] GetSystemMetrics (nIndex=11) returned 32 [0136.289] GetSystemMetrics (nIndex=12) returned 32 [0136.289] SetBkColor (hdc=0x10105e0, color=0x1) returned 0xffffff [0136.289] CreateCompatibleBitmap (hdc=0x10105e0, cx=1440, cy=900) returned 0x46050730 [0136.316] SelectObject (hdc=0x5301074e, h=0x46050730) returned 0x185000f [0136.317] BitBlt (hdc=0x5301074e, x=0, y=0, cx=1440, cy=900, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0136.497] BitBlt (hdc=0x10105e0, x=0, y=10, cx=1440, cy=890, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0136.668] BitBlt (hdc=0x10105e0, x=0, y=0, cx=0, cy=900, hdcSrc=0x5301074e, x1=0, y1=0, rop=0xcc0020) returned 1 [0136.668] BitBlt (hdc=0x10105e0, x=0, y=0, cx=1440, cy=10, hdcSrc=0x5301074e, x1=0, y1=890, rop=0xcc0020) returned 1 [0136.668] DeleteDC (hdc=0x10105e0) returned 1 [0136.668] DeleteDC (hdc=0x5301074e) returned 1 [0136.669] DeleteObject (ho=0x46050730) returned 1 [0136.669] Sleep (dwMilliseconds=0x3e8) [0137.695] GetDesktopWindow () returned 0x10010 [0137.695] GetWindowDC (hWnd=0x10010) returned 0x10105e0 [0137.695] CreateCompatibleDC (hdc=0x10105e0) returned 0x5501074e [0137.695] GetWindowRect (in: hWnd=0x10010, lpRect=0xb66f6e8 | out: lpRect=0xb66f6e8) returned 1 [0137.695] GetCursorPos (in: lpPoint=0xb66f6e0 | out: lpPoint=0xb66f6e0*(x=830, y=558)) returned 1 [0137.695] GetSystemMetrics (nIndex=11) returned 32 [0137.696] GetSystemMetrics (nIndex=12) returned 32 [0137.696] SetBkColor (hdc=0x10105e0, color=0x1) returned 0xffffff [0137.696] CreateCompatibleBitmap (hdc=0x10105e0, cx=1440, cy=900) returned 0x48050730 [0137.723] SelectObject (hdc=0x5501074e, h=0x48050730) returned 0x185000f [0137.723] BitBlt (hdc=0x5501074e, x=0, y=0, cx=1440, cy=900, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0137.900] BitBlt (hdc=0x10105e0, x=0, y=10, cx=1440, cy=890, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0138.074] BitBlt (hdc=0x10105e0, x=0, y=0, cx=0, cy=900, hdcSrc=0x5501074e, x1=0, y1=0, rop=0xcc0020) returned 1 [0138.074] BitBlt (hdc=0x10105e0, x=0, y=0, cx=1440, cy=10, hdcSrc=0x5501074e, x1=0, y1=890, rop=0xcc0020) returned 1 [0138.074] DeleteDC (hdc=0x10105e0) returned 1 [0138.074] DeleteDC (hdc=0x5501074e) returned 1 [0138.074] DeleteObject (ho=0x48050730) returned 1 [0138.074] Sleep (dwMilliseconds=0x3e8) [0139.088] GetDesktopWindow () returned 0x10010 [0139.088] GetWindowDC (hWnd=0x10010) returned 0x10105e0 [0139.088] CreateCompatibleDC (hdc=0x10105e0) returned 0x5701074e [0139.088] GetWindowRect (in: hWnd=0x10010, lpRect=0xb66f6e8 | out: lpRect=0xb66f6e8) returned 1 [0139.088] GetCursorPos (in: lpPoint=0xb66f6e0 | out: lpPoint=0xb66f6e0*(x=830, y=558)) returned 1 [0139.088] GetSystemMetrics (nIndex=11) returned 32 [0139.088] GetSystemMetrics (nIndex=12) returned 32 [0139.088] SetBkColor (hdc=0x10105e0, color=0x1) returned 0xffffff [0139.088] CreateCompatibleBitmap (hdc=0x10105e0, cx=1440, cy=900) returned 0x4a050730 [0139.115] SelectObject (hdc=0x5701074e, h=0x4a050730) returned 0x185000f [0139.115] BitBlt (hdc=0x5701074e, x=0, y=0, cx=1440, cy=900, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0139.348] BitBlt (hdc=0x10105e0, x=0, y=10, cx=1440, cy=890, hdcSrc=0x10105e0, x1=0, y1=0, rop=0xcc0020) returned 1 [0139.633] BitBlt (hdc=0x10105e0, x=0, y=0, cx=0, cy=900, hdcSrc=0x5701074e, x1=0, y1=0, rop=0xcc0020) returned 1 [0139.633] BitBlt (hdc=0x10105e0, x=0, y=0, cx=1440, cy=10, hdcSrc=0x5701074e, x1=0, y1=890, rop=0xcc0020) returned 1 [0139.633] DeleteDC (hdc=0x10105e0) returned 1 [0139.633] DeleteDC (hdc=0x5701074e) returned 1 [0139.633] DeleteObject (ho=0x4a050730) returned 1 [0139.633] Sleep (dwMilliseconds=0x3e8) [0140.672] GetDesktopWindow () returned 0x10010 [0140.672] GetWindowDC (hWnd=0x10010) returned 0x2e01074a [0140.672] CreateCompatibleDC (hdc=0x2e01074a) returned 0xc3010707 [0140.672] GetWindowRect (in: hWnd=0x10010, lpRect=0xb66f6e8 | out: lpRect=0xb66f6e8) returned 1 [0140.673] GetCursorPos (in: lpPoint=0xb66f6e0 | out: lpPoint=0xb66f6e0*(x=169, y=746)) returned 1 [0140.673] GetSystemMetrics (nIndex=11) returned 32 [0140.673] GetSystemMetrics (nIndex=12) returned 32 [0140.673] SetBkColor (hdc=0x2e01074a, color=0x1) returned 0xffffff [0140.673] CreateCompatibleBitmap (hdc=0x2e01074a, cx=1440, cy=900) returned 0x4e050730 [0140.700] SelectObject (hdc=0xc3010707, h=0x4e050730) returned 0x185000f [0140.700] BitBlt (hdc=0xc3010707, x=0, y=0, cx=1440, cy=900, hdcSrc=0x2e01074a, x1=0, y1=0, rop=0xcc0020) returned 1 [0140.877] BitBlt (hdc=0x2e01074a, x=0, y=10, cx=1440, cy=890, hdcSrc=0x2e01074a, x1=0, y1=0, rop=0xcc0020) returned 1 [0141.048] BitBlt (hdc=0x2e01074a, x=0, y=0, cx=0, cy=900, hdcSrc=0xc3010707, x1=0, y1=0, rop=0xcc0020) returned 1 [0141.048] BitBlt (hdc=0x2e01074a, x=0, y=0, cx=1440, cy=10, hdcSrc=0xc3010707, x1=0, y1=890, rop=0xcc0020) returned 1 [0141.048] DeleteDC (hdc=0x2e01074a) returned 1 [0141.048] DeleteDC (hdc=0xc3010707) returned 1 [0141.048] DeleteObject (ho=0x4e050730) returned 1 [0141.049] Sleep (dwMilliseconds=0x3e8) [0142.076] GetDesktopWindow () returned 0x10010 [0142.076] GetWindowDC (hWnd=0x10010) returned 0xe010746 [0142.076] CreateCompatibleDC (hdc=0xe010746) returned 0x52010730 [0142.076] GetWindowRect (in: hWnd=0x10010, lpRect=0xb66f6e8 | out: lpRect=0xb66f6e8) returned 1 [0142.076] GetCursorPos (in: lpPoint=0xb66f6e0 | out: lpPoint=0xb66f6e0*(x=169, y=746)) returned 1 [0142.076] GetSystemMetrics (nIndex=11) returned 32 [0142.076] GetSystemMetrics (nIndex=12) returned 32 [0142.076] SetBkColor (hdc=0xe010746, color=0x1) returned 0xffffff [0142.076] CreateCompatibleBitmap (hdc=0xe010746, cx=1440, cy=900) returned 0xd05075e [0142.104] SelectObject (hdc=0x52010730, h=0xd05075e) returned 0x185000f [0142.104] BitBlt (hdc=0x52010730, x=0, y=0, cx=1440, cy=900, hdcSrc=0xe010746, x1=0, y1=0, rop=0xcc0020) returned 1 [0142.320] BitBlt (hdc=0xe010746, x=0, y=10, cx=1440, cy=890, hdcSrc=0xe010746, x1=0, y1=0, rop=0xcc0020) returned 1 [0142.506] BitBlt (hdc=0xe010746, x=0, y=0, cx=0, cy=900, hdcSrc=0x52010730, x1=0, y1=0, rop=0xcc0020) returned 1 [0142.506] BitBlt (hdc=0xe010746, x=0, y=0, cx=1440, cy=10, hdcSrc=0x52010730, x1=0, y1=890, rop=0xcc0020) returned 1 [0142.506] DeleteDC (hdc=0xe010746) returned 1 [0142.506] DeleteDC (hdc=0x52010730) returned 1 [0142.506] DeleteObject (ho=0xd05075e) returned 1 [0142.506] Sleep (dwMilliseconds=0x3e8) [0143.523] GetDesktopWindow () returned 0x10010 [0143.523] GetWindowDC (hWnd=0x10010) returned 0x6c010730 [0143.523] CreateCompatibleDC (hdc=0x6c010730) returned 0x22010759 [0143.523] GetWindowRect (in: hWnd=0x10010, lpRect=0xb66f6e8 | out: lpRect=0xb66f6e8) returned 1 [0143.523] GetCursorPos (in: lpPoint=0xb66f6e0 | out: lpPoint=0xb66f6e0*(x=169, y=746)) returned 1 [0143.523] GetSystemMetrics (nIndex=11) returned 32 [0143.523] GetSystemMetrics (nIndex=12) returned 32 [0143.523] SetBkColor (hdc=0x6c010730, color=0x1) returned 0xffffff [0143.523] CreateCompatibleBitmap (hdc=0x6c010730, cx=1440, cy=900) returned 0xffffffff84050565 [0143.554] SelectObject (hdc=0x22010759, h=0x84050565) returned 0x185000f [0143.555] BitBlt (hdc=0x22010759, x=0, y=0, cx=1440, cy=900, hdcSrc=0x6c010730, x1=0, y1=0, rop=0xcc0020) returned 1 [0143.754] BitBlt (hdc=0x6c010730, x=0, y=10, cx=1440, cy=890, hdcSrc=0x6c010730, x1=0, y1=0, rop=0xcc0020) returned 1 [0143.976] BitBlt (hdc=0x6c010730, x=0, y=0, cx=0, cy=900, hdcSrc=0x22010759, x1=0, y1=0, rop=0xcc0020) returned 1 [0143.976] BitBlt (hdc=0x6c010730, x=0, y=0, cx=1440, cy=10, hdcSrc=0x22010759, x1=0, y1=890, rop=0xcc0020) returned 1 [0143.976] DeleteDC (hdc=0x6c010730) returned 1 [0143.986] DeleteDC (hdc=0x22010759) returned 1 [0143.986] DeleteObject (ho=0x84050565) returned 1 [0143.986] Sleep (dwMilliseconds=0x3e8) Thread: id = 24 os_tid = 0x2d0 [0139.889] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0139.889] RoInitialize () returned 0x1 [0139.889] RoUninitialize () returned 0x0 [0139.937] GetDesktopWindow () returned 0x10010 [0139.937] GetWindowDC (hWnd=0x10010) returned 0x10105e0 [0139.937] CreateCompatibleDC (hdc=0x10105e0) returned 0x5a01074e [0139.937] GetWindowRect (in: hWnd=0x10010, lpRect=0xb26f138 | out: lpRect=0xb26f138) returned 1 [0139.937] GetCursorPos (in: lpPoint=0xb26f130 | out: lpPoint=0xb26f130*(x=169, y=746)) returned 1 [0139.937] GetSystemMetrics (nIndex=11) returned 32 [0139.937] GetSystemMetrics (nIndex=12) returned 32 [0139.937] SetBkColor (hdc=0x10105e0, color=0x1) returned 0xffffff [0139.937] LoadIconW (hInstance=0x0, lpIconName=0x7f03) returned 0x10029 [0139.986] rand () returned 41 [0139.986] rand () returned 18467 [0139.986] DrawIcon (hDC=0x10105e0, X=1379, Y=41, hIcon=0x10029) returned 1 [0139.987] Sleep (dwMilliseconds=0x1f4) [0140.489] GetDesktopWindow () returned 0x10010 [0140.489] GetWindowDC (hWnd=0x10010) returned 0xa0100d0 [0140.489] CreateCompatibleDC (hdc=0xa0100d0) returned 0x2f010749 [0140.489] GetWindowRect (in: hWnd=0x10010, lpRect=0xb26f138 | out: lpRect=0xb26f138) returned 1 [0140.489] GetCursorPos (in: lpPoint=0xb26f130 | out: lpPoint=0xb26f130*(x=169, y=746)) returned 1 [0140.489] GetSystemMetrics (nIndex=11) returned 32 [0140.489] GetSystemMetrics (nIndex=12) returned 32 [0140.489] SetBkColor (hdc=0xa0100d0, color=0x1) returned 0xffffff [0140.489] LoadIconW (hInstance=0x0, lpIconName=0x7f03) returned 0x10029 [0140.489] rand () returned 6334 [0140.489] rand () returned 26500 [0140.489] DrawIcon (hDC=0xa0100d0, X=868, Y=146, hIcon=0x10029) returned 1 [0140.489] Sleep (dwMilliseconds=0x1f4) [0141.046] GetDesktopWindow () returned 0x10010 [0141.046] GetWindowDC (hWnd=0x10010) returned 0x1301063b [0141.046] CreateCompatibleDC (hdc=0x1301063b) returned 0x10010747 [0141.046] GetWindowRect (in: hWnd=0x10010, lpRect=0xb26f138 | out: lpRect=0xb26f138) returned 1 [0141.046] GetCursorPos (in: lpPoint=0xb26f130 | out: lpPoint=0xb26f130*(x=169, y=746)) returned 1 [0141.046] GetSystemMetrics (nIndex=11) returned 32 [0141.046] GetSystemMetrics (nIndex=12) returned 32 [0141.046] SetBkColor (hdc=0x1301063b, color=0x1) returned 0xffffff [0141.046] LoadIconW (hInstance=0x0, lpIconName=0x7f03) returned 0x10029 [0141.046] rand () returned 19169 [0141.046] rand () returned 15724 [0141.046] DrawIcon (hDC=0x1301063b, X=60, Y=605, hIcon=0x10029) returned 1 [0141.047] Sleep (dwMilliseconds=0x1f4) [0141.561] GetDesktopWindow () returned 0x10010 [0141.562] GetWindowDC (hWnd=0x10010) returned 0x2e01074a [0141.562] CreateCompatibleDC (hdc=0x2e01074a) returned 0xc5010707 [0141.562] GetWindowRect (in: hWnd=0x10010, lpRect=0xb26f138 | out: lpRect=0xb26f138) returned 1 [0141.562] GetCursorPos (in: lpPoint=0xb26f130 | out: lpPoint=0xb26f130*(x=169, y=746)) returned 1 [0141.562] GetSystemMetrics (nIndex=11) returned 32 [0141.562] GetSystemMetrics (nIndex=12) returned 32 [0141.562] SetBkColor (hdc=0x2e01074a, color=0x1) returned 0xffffff [0141.562] LoadIconW (hInstance=0x0, lpIconName=0x7f03) returned 0x10029 [0141.562] rand () returned 11478 [0141.562] rand () returned 29358 [0141.562] DrawIcon (hDC=0x2e01074a, X=878, Y=870, hIcon=0x10029) returned 1 [0141.562] Sleep (dwMilliseconds=0x1f4) [0142.104] GetDesktopWindow () returned 0x10010 [0142.104] GetWindowDC (hWnd=0x10010) returned 0x1c0101b9 [0142.105] CreateCompatibleDC (hdc=0x1c0101b9) returned 0x3001053d [0142.105] GetWindowRect (in: hWnd=0x10010, lpRect=0xb26f138 | out: lpRect=0xb26f138) returned 1 [0142.105] GetCursorPos (in: lpPoint=0xb26f130 | out: lpPoint=0xb26f130*(x=169, y=746)) returned 1 [0142.105] GetSystemMetrics (nIndex=11) returned 32 [0142.105] GetSystemMetrics (nIndex=12) returned 32 [0142.105] SetBkColor (hdc=0x1c0101b9, color=0x1) returned 0xffffff [0142.105] LoadIconW (hInstance=0x0, lpIconName=0x7f03) returned 0x10029 [0142.105] rand () returned 26962 [0142.105] rand () returned 24464 [0142.105] DrawIcon (hDC=0x1c0101b9, X=256, Y=442, hIcon=0x10029) returned 1 [0142.105] Sleep (dwMilliseconds=0x1f4) [0143.026] GetDesktopWindow () returned 0x10010 [0143.026] GetWindowDC (hWnd=0x10010) returned 0xe010746 [0143.026] CreateCompatibleDC (hdc=0xe010746) returned 0x8010786 [0143.026] GetWindowRect (in: hWnd=0x10010, lpRect=0xb26f138 | out: lpRect=0xb26f138) returned 1 [0143.026] GetCursorPos (in: lpPoint=0xb26f130 | out: lpPoint=0xb26f130*(x=169, y=746)) returned 1 [0143.026] GetSystemMetrics (nIndex=11) returned 32 [0143.026] GetSystemMetrics (nIndex=12) returned 32 [0143.026] SetBkColor (hdc=0xe010746, color=0x1) returned 0xffffff [0143.026] LoadIconW (hInstance=0x0, lpIconName=0x7f03) returned 0x10029 [0143.026] rand () returned 5705 [0143.026] rand () returned 28145 [0143.026] DrawIcon (hDC=0xe010746, X=1089, Y=401, hIcon=0x10029) returned 1 [0143.026] Sleep (dwMilliseconds=0x1f4) [0143.728] GetDesktopWindow () returned 0x10010 [0143.728] GetWindowDC (hWnd=0x10010) returned 0x2801077e [0143.728] CreateCompatibleDC (hdc=0x2801077e) returned 0x170105db [0143.728] GetWindowRect (in: hWnd=0x10010, lpRect=0xb26f138 | out: lpRect=0xb26f138) returned 1 [0143.728] GetCursorPos (in: lpPoint=0xb26f130 | out: lpPoint=0xb26f130*(x=169, y=746)) returned 1 [0143.728] GetSystemMetrics (nIndex=11) returned 32 [0143.728] GetSystemMetrics (nIndex=12) returned 32 [0143.728] SetBkColor (hdc=0x2801077e, color=0x1) returned 0xffffff [0143.728] LoadIconW (hInstance=0x0, lpIconName=0x7f03) returned 0x10029 [0143.728] rand () returned 23281 [0143.728] rand () returned 16827 [0143.728] DrawIcon (hDC=0x2801077e, X=1163, Y=297, hIcon=0x10029) returned 1 [0143.753] Sleep (dwMilliseconds=0x1f4) [0144.347] GetDesktopWindow () returned 0x10010 [0144.347] GetWindowDC (hWnd=0x10010) returned 0x50010770 [0144.347] CreateCompatibleDC (hdc=0x50010770) returned 0xa010790 [0144.347] GetWindowRect (in: hWnd=0x10010, lpRect=0xb26f138 | out: lpRect=0xb26f138) returned 1 [0144.347] GetCursorPos (in: lpPoint=0xb26f130 | out: lpPoint=0xb26f130*(x=169, y=746)) returned 1 [0144.347] GetSystemMetrics (nIndex=11) returned 32 [0144.347] GetSystemMetrics (nIndex=12) returned 32 [0144.347] SetBkColor (hdc=0x50010770, color=0x1) returned 0xffffff [0144.347] LoadIconW (hInstance=0x0, lpIconName=0x7f03) returned 0x10029 [0144.347] rand () returned 9961 [0144.347] rand () returned 491 [0144.347] DrawIcon (hDC=0x50010770, X=491, Y=237, hIcon=0x10029) returned 1 [0144.348] Sleep (dwMilliseconds=0x1f4) Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x7beb4000" os_pid = "0xdf4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x950" cmd_line = "C:\\Windows\\system32\\cmd.exe /c \"\"C:\\WinWOW32\\\\work.bat\"\"" cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013c81" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 311 start_va = 0x9b0000 end_va = 0x9cffff entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 312 start_va = 0x9d0000 end_va = 0x9d1fff entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 313 start_va = 0x9e0000 end_va = 0x9f3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 314 start_va = 0xa00000 end_va = 0xa3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 315 start_va = 0xa40000 end_va = 0xb3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 316 start_va = 0xb40000 end_va = 0xb43fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b40000" filename = "" Region: id = 317 start_va = 0xb50000 end_va = 0xb50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 318 start_va = 0xb60000 end_va = 0xb61fff entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 319 start_va = 0xe70000 end_va = 0xebffff entry_point = 0xe70000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 320 start_va = 0xec0000 end_va = 0x4ebffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ec0000" filename = "" Region: id = 321 start_va = 0x77990000 end_va = 0x77b08fff entry_point = 0x77990000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 322 start_va = 0x7ec50000 end_va = 0x7ec72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ec50000" filename = "" Region: id = 323 start_va = 0x7ec79000 end_va = 0x7ec7bfff entry_point = 0x0 region_type = private name = "private_0x000000007ec79000" filename = "" Region: id = 324 start_va = 0x7ec7c000 end_va = 0x7ec7cfff entry_point = 0x0 region_type = private name = "private_0x000000007ec7c000" filename = "" Region: id = 325 start_va = 0x7ec7f000 end_va = 0x7ec7ffff entry_point = 0x0 region_type = private name = "private_0x000000007ec7f000" filename = "" Region: id = 326 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 327 start_va = 0x7fff0000 end_va = 0x7dfaf7a0ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 328 start_va = 0x7dfaf7a10000 end_va = 0x7ffaf7a0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfaf7a10000" filename = "" Region: id = 329 start_va = 0x7ffaf7a10000 end_va = 0x7ffaf7bd1fff entry_point = 0x7ffaf7a10000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 330 start_va = 0x7ffaf7bd2000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffaf7bd2000" filename = "" Region: id = 331 start_va = 0xba0000 end_va = 0xbaffff entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 332 start_va = 0x73040000 end_va = 0x7308efff entry_point = 0x73040000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 333 start_va = 0x73090000 end_va = 0x73102fff entry_point = 0x73090000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 334 start_va = 0xd60000 end_va = 0xe5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 335 start_va = 0x73030000 end_va = 0x73037fff entry_point = 0x73030000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 411 start_va = 0x9b0000 end_va = 0x9bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 412 start_va = 0xbb0000 end_va = 0xc6dfff entry_point = 0xbb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 413 start_va = 0xc70000 end_va = 0xcaffff entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 414 start_va = 0x4ec0000 end_va = 0x4fbffff entry_point = 0x0 region_type = private name = "private_0x0000000004ec0000" filename = "" Region: id = 415 start_va = 0x5070000 end_va = 0x507ffff entry_point = 0x0 region_type = private name = "private_0x0000000005070000" filename = "" Region: id = 416 start_va = 0x74d30000 end_va = 0x74ea5fff entry_point = 0x74d30000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 417 start_va = 0x75130000 end_va = 0x7521ffff entry_point = 0x75130000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 418 start_va = 0x778d0000 end_va = 0x7798dfff entry_point = 0x778d0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 419 start_va = 0x7eb50000 end_va = 0x7ec4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eb50000" filename = "" Region: id = 420 start_va = 0x7ec76000 end_va = 0x7ec78fff entry_point = 0x0 region_type = private name = "private_0x000000007ec76000" filename = "" Region: id = 421 start_va = 0x9c0000 end_va = 0x9c3fff entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 422 start_va = 0x9d0000 end_va = 0x9d3fff entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 423 start_va = 0x73150000 end_va = 0x73157fff entry_point = 0x73150000 region_type = mapped_file name = "cmdext.dll" filename = "\\Windows\\SysWOW64\\cmdext.dll" (normalized: "c:\\windows\\syswow64\\cmdext.dll") Region: id = 424 start_va = 0x74c60000 end_va = 0x74cdafff entry_point = 0x74c60000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 425 start_va = 0x770b0000 end_va = 0x770f2fff entry_point = 0x770b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 426 start_va = 0x772c0000 end_va = 0x7736bfff entry_point = 0x772c0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 427 start_va = 0x74aa0000 end_va = 0x74abdfff entry_point = 0x74aa0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 428 start_va = 0x74a90000 end_va = 0x74a99fff entry_point = 0x74a90000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 429 start_va = 0x74a30000 end_va = 0x74a88fff entry_point = 0x74a30000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 430 start_va = 0xb70000 end_va = 0xb7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 431 start_va = 0x5080000 end_va = 0x53b6fff entry_point = 0x5080000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 9 os_tid = 0xdfc [0122.582] GetModuleHandleA (lpModuleName=0x0) returned 0xe70000 [0122.582] __set_app_type (_Type=0x1) [0122.582] __p__fmode () returned 0x77984d6c [0122.582] __p__commode () returned 0x77985b1c [0122.582] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xe836e0) returned 0x0 [0122.582] __getmainargs (in: _Argc=0xe950e8, _Argv=0xe950ec, _Env=0xe950f0, _DoWildCard=0, _StartInfo=0xe950fc | out: _Argc=0xe950e8, _Argv=0xe950ec, _Env=0xe950f0) returned 0 [0122.582] GetCurrentThreadId () returned 0xdfc [0122.582] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xdfc) returned 0x84 [0122.582] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0122.583] GetProcAddress (hModule=0x75130000, lpProcName="SetThreadUILanguage") returned 0x75172780 [0122.583] SetThreadUILanguage (LangId=0x0) returned 0x409 [0122.591] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0122.591] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xb3f8cc | out: phkResult=0xb3f8cc*=0x0) returned 0x2 [0122.591] VirtualQuery (in: lpAddress=0xb3f8d3, lpBuffer=0xb3f884, dwLength=0x1c | out: lpBuffer=0xb3f884*(BaseAddress=0xb3f000, AllocationBase=0xa40000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0122.591] VirtualQuery (in: lpAddress=0xa40000, lpBuffer=0xb3f884, dwLength=0x1c | out: lpBuffer=0xb3f884*(BaseAddress=0xa40000, AllocationBase=0xa40000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0122.591] VirtualQuery (in: lpAddress=0xa41000, lpBuffer=0xb3f884, dwLength=0x1c | out: lpBuffer=0xb3f884*(BaseAddress=0xa41000, AllocationBase=0xa40000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0122.591] VirtualQuery (in: lpAddress=0xa43000, lpBuffer=0xb3f884, dwLength=0x1c | out: lpBuffer=0xb3f884*(BaseAddress=0xa43000, AllocationBase=0xa40000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0122.592] VirtualQuery (in: lpAddress=0xb40000, lpBuffer=0xb3f884, dwLength=0x1c | out: lpBuffer=0xb3f884*(BaseAddress=0xb40000, AllocationBase=0xb40000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0122.592] GetConsoleOutputCP () returned 0x1b5 [0122.597] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xe9e460 | out: lpCPInfo=0xe9e460) returned 1 [0122.597] SetConsoleCtrlHandler (HandlerRoutine=0xe8f980, Add=1) returned 1 [0122.597] _get_osfhandle (_FileHandle=1) returned 0x3c [0122.597] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x0) returned 1 [0122.683] _get_osfhandle (_FileHandle=1) returned 0x3c [0122.683] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe9e40c | out: lpMode=0xe9e40c) returned 1 [0122.790] _get_osfhandle (_FileHandle=1) returned 0x3c [0122.790] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0122.810] _get_osfhandle (_FileHandle=0) returned 0x38 [0122.810] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xe9e408 | out: lpMode=0xe9e408) returned 1 [0122.813] _get_osfhandle (_FileHandle=0) returned 0x38 [0122.813] SetConsoleMode (hConsoleHandle=0x38, dwMode=0x1e7) returned 1 [0122.887] GetEnvironmentStringsW () returned 0xd67dc0* [0122.887] FreeEnvironmentStringsA (penv="A") returned 1 [0122.888] GetEnvironmentStringsW () returned 0xd67dc0* [0122.888] FreeEnvironmentStringsA (penv="A") returned 1 [0122.888] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xb3e830 | out: phkResult=0xb3e830*=0x94) returned 0x0 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x0, lpData=0xb3e83c*=0x78, lpcbData=0xb3e838*=0x1000) returned 0x2 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x4, lpData=0xb3e83c*=0x1, lpcbData=0xb3e838*=0x4) returned 0x0 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x0, lpData=0xb3e83c*=0x1, lpcbData=0xb3e838*=0x1000) returned 0x2 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x4, lpData=0xb3e83c*=0x0, lpcbData=0xb3e838*=0x4) returned 0x0 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x4, lpData=0xb3e83c*=0x40, lpcbData=0xb3e838*=0x4) returned 0x0 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x4, lpData=0xb3e83c*=0x40, lpcbData=0xb3e838*=0x4) returned 0x0 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x0, lpData=0xb3e83c*=0x40, lpcbData=0xb3e838*=0x1000) returned 0x2 [0122.888] RegCloseKey (hKey=0x94) returned 0x0 [0122.888] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xb3e830 | out: phkResult=0xb3e830*=0x94) returned 0x0 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x0, lpData=0xb3e83c*=0x40, lpcbData=0xb3e838*=0x1000) returned 0x2 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x4, lpData=0xb3e83c*=0x1, lpcbData=0xb3e838*=0x4) returned 0x0 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x0, lpData=0xb3e83c*=0x1, lpcbData=0xb3e838*=0x1000) returned 0x2 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x4, lpData=0xb3e83c*=0x0, lpcbData=0xb3e838*=0x4) returned 0x0 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x4, lpData=0xb3e83c*=0x9, lpcbData=0xb3e838*=0x4) returned 0x0 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x4, lpData=0xb3e83c*=0x9, lpcbData=0xb3e838*=0x4) returned 0x0 [0122.888] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0xb3e834, lpData=0xb3e83c, lpcbData=0xb3e838*=0x1000 | out: lpType=0xb3e834*=0x0, lpData=0xb3e83c*=0x9, lpcbData=0xb3e838*=0x1000) returned 0x2 [0122.888] RegCloseKey (hKey=0x94) returned 0x0 [0122.888] time (in: timer=0x0 | out: timer=0x0) returned 0x5b938ea2 [0122.888] srand (_Seed=0x5b938ea2) [0122.888] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c \"\"C:\\WinWOW32\\\\work.bat\"\"" [0122.888] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c \"\"C:\\WinWOW32\\\\work.bat\"\"" [0122.889] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xea6720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0122.889] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd69d18, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0122.889] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0122.889] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0122.889] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0122.889] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0122.889] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0122.889] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0122.889] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0122.889] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0122.889] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0122.889] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0122.889] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0122.889] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0122.889] GetEnvironmentStringsW () returned 0xd67dc0* [0122.889] FreeEnvironmentStringsA (penv="A") returned 1 [0122.889] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0122.889] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0122.889] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0122.889] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0122.889] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0122.889] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0122.889] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0122.889] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0122.889] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0122.890] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0122.890] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xb3f608 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0122.890] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x104, lpBuffer=0xb3f608, lpFilePart=0xb3f600 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xb3f600*="Desktop") returned 0x1d [0122.890] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0122.890] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xb3f388 | out: lpFindFileData=0xb3f388) returned 0xd605c8 [0122.890] FindClose (in: hFindFile=0xd605c8 | out: hFindFile=0xd605c8) returned 1 [0122.890] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", lpFindFileData=0xb3f388 | out: lpFindFileData=0xb3f388) returned 0xd605c8 [0122.890] FindClose (in: hFindFile=0xd605c8 | out: hFindFile=0xd605c8) returned 1 [0122.890] _wcsnicmp (_String1="CIIHMN~1", _String2="CIiHmnxMn6Ps", _MaxCount=0xc) returned 6 [0122.890] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFindFileData=0xb3f388 | out: lpFindFileData=0xb3f388) returned 0xd605c8 [0122.890] FindClose (in: hFindFile=0xd605c8 | out: hFindFile=0xd605c8) returned 1 [0122.890] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0122.890] SetCurrentDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 1 [0122.890] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0122.891] GetEnvironmentStringsW () returned 0xd67dc0* [0122.891] FreeEnvironmentStringsA (penv="=") returned 1 [0122.891] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xea6720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0122.891] GetConsoleOutputCP () returned 0x1b5 [0122.982] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xe9e460 | out: lpCPInfo=0xe9e460) returned 1 [0122.982] GetUserDefaultLCID () returned 0x409 [0122.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xea24a0, cchData=8 | out: lpLCData=":") returned 2 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xb3f738, cchData=128 | out: lpLCData="0") returned 2 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xb3f738, cchData=128 | out: lpLCData="0") returned 2 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xb3f738, cchData=128 | out: lpLCData="1") returned 2 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xea24b0, cchData=8 | out: lpLCData="/") returned 2 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xea2500, cchData=32 | out: lpLCData="Mon") returned 4 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xea2540, cchData=32 | out: lpLCData="Tue") returned 4 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xea2580, cchData=32 | out: lpLCData="Wed") returned 4 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xea25c0, cchData=32 | out: lpLCData="Thu") returned 4 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xea2600, cchData=32 | out: lpLCData="Fri") returned 4 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xea2640, cchData=32 | out: lpLCData="Sat") returned 4 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xea2680, cchData=32 | out: lpLCData="Sun") returned 4 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xea24c0, cchData=8 | out: lpLCData=".") returned 2 [0122.983] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xea24e0, cchData=8 | out: lpLCData=",") returned 2 [0122.983] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0122.984] GetConsoleTitleW (in: lpConsoleTitle=0xd6aa40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0123.028] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75130000 [0123.028] GetProcAddress (hModule=0x75130000, lpProcName="CopyFileExW") returned 0x7514fa80 [0123.028] GetProcAddress (hModule=0x75130000, lpProcName="IsDebuggerPresent") returned 0x7514a790 [0123.028] GetProcAddress (hModule=0x75130000, lpProcName="SetConsoleInputExeNameW") returned 0x74e435c0 [0123.029] _wcsicmp (_String1="\"C:\\WinWOW32\\\\work.bat\"", _String2=")") returned -7 [0123.029] _wcsicmp (_String1="FOR", _String2="\"C:\\WinWOW32\\\\work.bat\"") returned 68 [0123.029] _wcsicmp (_String1="FOR/?", _String2="\"C:\\WinWOW32\\\\work.bat\"") returned 68 [0123.029] _wcsicmp (_String1="IF", _String2="\"C:\\WinWOW32\\\\work.bat\"") returned 71 [0123.029] _wcsicmp (_String1="IF/?", _String2="\"C:\\WinWOW32\\\\work.bat\"") returned 71 [0123.029] _wcsicmp (_String1="REM", _String2="\"C:\\WinWOW32\\\\work.bat\"") returned 80 [0123.029] _wcsicmp (_String1="REM/?", _String2="\"C:\\WinWOW32\\\\work.bat\"") returned 80 [0123.030] GetConsoleTitleW (in: lpConsoleTitle=0xb3f420, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0123.030] GetFileAttributesW (lpFileName="\"C:\\WinWOW32\\\\work.bat\"" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\\"c:\\winwow32\\work.bat\"")) returned 0xffffffff [0123.030] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0123.030] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0123.030] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0123.030] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0123.030] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0123.030] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0123.030] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0123.030] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0123.030] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0123.030] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0123.030] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0123.030] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0123.030] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0123.030] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0123.030] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0123.030] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0123.030] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0123.030] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0123.030] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0123.030] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0123.030] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0123.030] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0123.030] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0123.030] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0123.030] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0123.030] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0123.031] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0123.031] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0123.031] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0123.031] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0123.031] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0123.031] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0123.031] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0123.031] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0123.031] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0123.031] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0123.031] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0123.031] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0123.031] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0123.031] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0123.031] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0123.031] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0123.031] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0123.031] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0123.031] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0123.031] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0123.031] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0123.031] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0123.031] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0123.031] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0123.031] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0123.031] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0123.031] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0123.031] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0123.031] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0123.031] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0123.031] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0123.031] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0123.031] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0123.031] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0123.031] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0123.031] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0123.031] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0123.031] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0123.031] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0123.031] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0123.031] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0123.031] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0123.031] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0123.031] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0123.031] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0123.031] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0123.031] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0123.031] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0123.031] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0123.031] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0123.031] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0123.032] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0123.032] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0123.032] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0123.032] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0123.032] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0123.032] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0123.032] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0123.032] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0123.032] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0123.032] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0123.032] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51 [0123.032] SetErrorMode (uMode=0x0) returned 0x0 [0123.032] SetErrorMode (uMode=0x1) returned 0x0 [0123.032] GetFullPathNameW (in: lpFileName="C:\\WinWOW32\\\\.", nBufferLength=0x208, lpBuffer=0xd6af58, lpFilePart=0xb3ef2c | out: lpBuffer="C:\\WinWOW32", lpFilePart=0xb3ef2c*="WinWOW32") returned 0xb [0123.032] SetErrorMode (uMode=0x0) returned 0x1 [0123.032] NeedCurrentDirectoryForExePathW (ExeName="C:\\WinWOW32\\\\.") returned 1 [0123.033] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0123.035] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0123.035] FindFirstFileExW (in: lpFileName="C:\\WinWOW32\\work.bat", fInfoLevelId=0x1, lpFindFileData=0xb3ecd8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ecd8) returned 0xd6b070 [0123.035] FindClose (in: hFindFile=0xd6b070 | out: hFindFile=0xd6b070) returned 1 [0123.035] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0123.035] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0123.035] GetConsoleTitleW (in: lpConsoleTitle=0xb3f1ac, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0123.036] ApiSetQueryApiSetPresence () returned 0x0 [0123.036] ResolveDelayLoadedAPI () returned 0x731514a0 [0123.073] SaferWorker () returned 0x0 [0123.084] SetErrorMode (uMode=0x0) returned 0x0 [0123.084] SetErrorMode (uMode=0x1) returned 0x0 [0123.084] GetFullPathNameW (in: lpFileName="C:\\WinWOW32\\work.bat", nBufferLength=0x104, lpBuffer=0xd6ad00, lpFilePart=0xb3f05c | out: lpBuffer="C:\\WinWOW32\\work.bat", lpFilePart=0xb3f05c*="work.bat") returned 0x14 [0123.084] SetErrorMode (uMode=0x0) returned 0x1 [0123.085] CmdBatNotificationStub () returned 0x1 [0123.085] CreateFileW (lpFileName="C:\\WinWOW32\\work.bat" (normalized: "c:\\winwow32\\work.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb3f0ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0123.085] _open_osfhandle (_OSFileHandle=0xb4, _Flags=8) returned 3 [0123.085] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.085] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.085] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.085] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.086] ReadFile (in: hFile=0xb4, lpBuffer=0xeaa960, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xb3f0bc, lpOverlapped=0x0 | out: lpBuffer=0xeaa960*, lpNumberOfBytesRead=0xb3f0bc*=0x322, lpOverlapped=0x0) returned 1 [0123.086] SetFilePointer (in: hFile=0xb4, lDistanceToMove=11, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0123.086] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xeaa960, cbMultiByte=11, lpWideCharStr=0xe957e0, cchWideChar=8191 | out: lpWideCharStr="@echo off\r\n") returned 11 [0123.087] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.087] GetFileType (hFile=0xb4) returned 0x1 [0123.087] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.087] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0123.087] _wcsicmp (_String1="echo", _String2=")") returned 60 [0123.087] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0123.087] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0123.087] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0123.087] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0123.087] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0123.087] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0123.088] _tell (_FileHandle=3) returned 11 [0123.088] _close (_FileHandle=3) returned 0 [0123.088] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0123.088] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0123.088] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0123.088] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0123.088] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0123.088] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0123.088] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0123.088] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0123.088] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0123.088] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0123.088] GetConsoleTitleW (in: lpConsoleTitle=0xb3eca0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0123.141] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0123.141] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0123.141] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0123.141] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0123.141] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0123.141] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0123.141] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0123.142] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0123.142] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0123.142] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0123.142] _wcsnicmp (_String1="off", _String2="off", _MaxCount=0x3) returned 0 [0123.142] _get_osfhandle (_FileHandle=1) returned 0x3c [0123.142] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0123.191] _get_osfhandle (_FileHandle=1) returned 0x3c [0123.191] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe9e40c | out: lpMode=0xe9e40c) returned 1 [0123.279] _get_osfhandle (_FileHandle=0) returned 0x38 [0123.279] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xe9e408 | out: lpMode=0xe9e408) returned 1 [0123.415] SetConsoleInputExeNameW () returned 0x1 [0123.415] GetConsoleOutputCP () returned 0x1b5 [0123.549] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xe9e460 | out: lpCPInfo=0xe9e460) returned 1 [0123.550] SetThreadUILanguage (LangId=0x0) returned 0x409 [0123.680] CreateFileW (lpFileName="C:\\WinWOW32\\work.bat" (normalized: "c:\\winwow32\\work.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb3f0ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0123.680] _open_osfhandle (_OSFileHandle=0xb4, _Flags=8) returned 3 [0123.680] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.680] SetFilePointer (in: hFile=0xb4, lDistanceToMove=11, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0123.681] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.681] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0123.681] ReadFile (in: hFile=0xb4, lpBuffer=0xeaa960, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xb3f0bc, lpOverlapped=0x0 | out: lpBuffer=0xeaa960*, lpNumberOfBytesRead=0xb3f0bc*=0x317, lpOverlapped=0x0) returned 1 [0123.681] SetFilePointer (in: hFile=0xb4, lDistanceToMove=22, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16 [0123.681] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xeaa960, cbMultiByte=11, lpWideCharStr=0xe957e0, cchWideChar=8191 | out: lpWideCharStr="goto main\r\n") returned 11 [0123.681] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.681] GetFileType (hFile=0xb4) returned 0x1 [0123.681] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.681] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16 [0123.681] _wcsicmp (_String1="goto", _String2=")") returned 62 [0123.681] _wcsicmp (_String1="FOR", _String2="goto") returned -1 [0123.681] _wcsicmp (_String1="FOR/?", _String2="goto") returned -1 [0123.681] _wcsicmp (_String1="IF", _String2="goto") returned 2 [0123.681] _wcsicmp (_String1="IF/?", _String2="goto") returned 2 [0123.681] _wcsicmp (_String1="REM", _String2="goto") returned 11 [0123.681] _wcsicmp (_String1="REM/?", _String2="goto") returned 11 [0123.682] _tell (_FileHandle=3) returned 22 [0123.682] _close (_FileHandle=3) returned 0 [0123.682] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0123.682] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0123.682] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0123.682] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0123.682] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0123.682] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0123.682] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0123.682] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0123.682] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0123.682] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0123.682] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0123.682] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0123.682] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0123.682] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0123.682] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0123.683] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0123.683] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0123.683] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0123.683] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0123.683] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0123.683] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0123.683] GetConsoleTitleW (in: lpConsoleTitle=0xb3eca0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0123.805] _wcsicmp (_String1="goto", _String2="DIR") returned 3 [0123.805] _wcsicmp (_String1="goto", _String2="ERASE") returned 2 [0123.805] _wcsicmp (_String1="goto", _String2="DEL") returned 3 [0123.805] _wcsicmp (_String1="goto", _String2="TYPE") returned -13 [0123.805] _wcsicmp (_String1="goto", _String2="COPY") returned 4 [0123.805] _wcsicmp (_String1="goto", _String2="CD") returned 4 [0123.805] _wcsicmp (_String1="goto", _String2="CHDIR") returned 4 [0123.805] _wcsicmp (_String1="goto", _String2="RENAME") returned -11 [0123.805] _wcsicmp (_String1="goto", _String2="REN") returned -11 [0123.805] _wcsicmp (_String1="goto", _String2="ECHO") returned 2 [0123.805] _wcsicmp (_String1="goto", _String2="SET") returned -12 [0123.805] _wcsicmp (_String1="goto", _String2="PAUSE") returned -9 [0123.805] _wcsicmp (_String1="goto", _String2="DATE") returned 3 [0123.805] _wcsicmp (_String1="goto", _String2="TIME") returned -13 [0123.805] _wcsicmp (_String1="goto", _String2="PROMPT") returned -9 [0123.805] _wcsicmp (_String1="goto", _String2="MD") returned -6 [0123.805] _wcsicmp (_String1="goto", _String2="MKDIR") returned -6 [0123.805] _wcsicmp (_String1="goto", _String2="RD") returned -11 [0123.805] _wcsicmp (_String1="goto", _String2="RMDIR") returned -11 [0123.805] _wcsicmp (_String1="goto", _String2="PATH") returned -9 [0123.805] _wcsicmp (_String1="goto", _String2="GOTO") returned 0 [0123.806] CreateFileW (lpFileName="C:\\WinWOW32\\work.bat" (normalized: "c:\\winwow32\\work.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb3e9ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0123.806] _open_osfhandle (_OSFileHandle=0xb4, _Flags=8) returned 3 [0123.806] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.806] SetFilePointer (in: hFile=0xb4, lDistanceToMove=22, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x16 [0123.806] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.806] GetFileSize (in: hFile=0xb4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x322 [0123.806] _wcsnicmp (_String1="main", _String2=":EOF", _MaxCount=0x4) returned 51 [0123.806] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.806] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16 [0123.806] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.806] GetFileType (hFile=0xb4) returned 0x1 [0123.806] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x16 [0123.806] ReadFile (in: hFile=0xb4, lpBuffer=0xeaa960, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0xb3ea58, lpOverlapped=0x0 | out: lpBuffer=0xeaa960*, lpNumberOfBytesRead=0xb3ea58*=0x200, lpOverlapped=0x0) returned 1 [0123.807] SetFilePointer (in: hFile=0xb4, lDistanceToMove=24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x18 [0123.807] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xeaa960, cbMultiByte=2, lpWideCharStr=0xea2700, cchWideChar=512 | out: lpWideCharStr="\r\nain") returned 2 [0123.807] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.807] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18 [0123.807] _get_osfhandle (_FileHandle=3) returned 0xb4 [0123.807] GetFileType (hFile=0xb4) returned 0x1 [0123.807] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18 [0123.807] ReadFile (in: hFile=0xb4, lpBuffer=0xeaa960, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0xb3ea58, lpOverlapped=0x0 | out: lpBuffer=0xeaa960*, lpNumberOfBytesRead=0xb3ea58*=0x200, lpOverlapped=0x0) returned 1 [0123.807] SetFilePointer (in: hFile=0xb4, lDistanceToMove=31, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f [0123.807] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xeaa960, cbMultiByte=7, lpWideCharStr=0xea2700, cchWideChar=512 | out: lpWideCharStr=":main\r\nWOW32\\\\work.bat\"") returned 7 [0123.807] _wcsicmp (_String1="main", _String2="main") returned 0 [0123.807] _close (_FileHandle=3) returned 0 [0123.807] _get_osfhandle (_FileHandle=1) returned 0x3c [0123.807] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0123.899] _get_osfhandle (_FileHandle=1) returned 0x3c [0123.899] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe9e40c | out: lpMode=0xe9e40c) returned 1 [0123.992] _get_osfhandle (_FileHandle=0) returned 0x38 [0123.992] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xe9e408 | out: lpMode=0xe9e408) returned 1 [0124.102] SetConsoleInputExeNameW () returned 0x1 [0124.102] GetConsoleOutputCP () returned 0x1b5 [0124.211] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xe9e460 | out: lpCPInfo=0xe9e460) returned 1 [0124.211] SetThreadUILanguage (LangId=0x0) returned 0x409 [0124.321] CreateFileW (lpFileName="C:\\WinWOW32\\work.bat" (normalized: "c:\\winwow32\\work.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb3f0ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0124.321] _open_osfhandle (_OSFileHandle=0xb4, _Flags=8) returned 3 [0124.321] _get_osfhandle (_FileHandle=3) returned 0xb4 [0124.321] SetFilePointer (in: hFile=0xb4, lDistanceToMove=31, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1f [0124.322] _get_osfhandle (_FileHandle=3) returned 0xb4 [0124.322] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f [0124.322] ReadFile (in: hFile=0xb4, lpBuffer=0xeaa960, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xb3f0bc, lpOverlapped=0x0 | out: lpBuffer=0xeaa960*, lpNumberOfBytesRead=0xb3f0bc*=0x303, lpOverlapped=0x0) returned 1 [0124.322] SetFilePointer (in: hFile=0xb4, lDistanceToMove=56, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38 [0124.322] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xeaa960, cbMultiByte=25, lpWideCharStr=0xe957e0, cchWideChar=8191 | out: lpWideCharStr="cd\\&cd Windows\\System32\r\n") returned 25 [0124.322] _get_osfhandle (_FileHandle=3) returned 0xb4 [0124.322] GetFileType (hFile=0xb4) returned 0x1 [0124.322] _get_osfhandle (_FileHandle=3) returned 0xb4 [0124.322] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38 [0124.323] _wcsicmp (_String1="cd\\", _String2=")") returned 58 [0124.323] _wcsicmp (_String1="FOR", _String2="cd\\") returned 3 [0124.323] _wcsicmp (_String1="FOR/?", _String2="cd\\") returned 3 [0124.323] _wcsicmp (_String1="IF", _String2="cd\\") returned 6 [0124.323] _wcsicmp (_String1="IF/?", _String2="cd\\") returned 6 [0124.323] _wcsicmp (_String1="REM", _String2="cd\\") returned 15 [0124.323] _wcsicmp (_String1="REM/?", _String2="cd\\") returned 15 [0124.323] _wcsicmp (_String1="cd", _String2=")") returned 58 [0124.323] _wcsicmp (_String1="FOR", _String2="cd") returned 3 [0124.323] _wcsicmp (_String1="FOR/?", _String2="cd") returned 3 [0124.324] _wcsicmp (_String1="IF", _String2="cd") returned 6 [0124.324] _wcsicmp (_String1="IF/?", _String2="cd") returned 6 [0124.324] _wcsicmp (_String1="REM", _String2="cd") returned 15 [0124.324] _wcsicmp (_String1="REM/?", _String2="cd") returned 15 [0124.325] _tell (_FileHandle=3) returned 56 [0124.325] _close (_FileHandle=3) returned 0 [0124.325] GetConsoleTitleW (in: lpConsoleTitle=0xb3ec40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0124.478] GetFileAttributesW (lpFileName="cd\\" (normalized: "cd")) returned 0xffffffff [0124.479] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0124.479] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0124.479] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0124.479] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0124.479] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0124.479] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0124.534] _wcsnicmp (_String1="\\", _String2="/D", _MaxCount=0x2) returned 45 [0124.534] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xb3e79c | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0124.534] GetFullPathNameW (in: lpFileName="\\", nBufferLength=0x104, lpBuffer=0xb3e79c, lpFilePart=0xb3e794 | out: lpBuffer="C:\\", lpFilePart=0xb3e794*=0x0) returned 0x3 [0124.534] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0124.534] FindFirstFileW (in: lpFileName="C:\\", lpFindFileData=0xb3e518 | out: lpFindFileData=0xb3e518) returned 0xffffffff [0124.534] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0124.534] SetCurrentDirectoryW (lpPathName="C:\\" (normalized: "c:")) returned 1 [0124.534] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\") returned 1 [0124.534] GetEnvironmentStringsW () returned 0xd69f28* [0124.534] FreeEnvironmentStringsA (penv="=") returned 1 [0124.534] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xea6720 | out: lpBuffer="C:\\") returned 0x3 [0124.535] GetConsoleTitleW (in: lpConsoleTitle=0xb3ec40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0124.613] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0124.613] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0124.613] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0124.613] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0124.613] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0124.613] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0124.614] _wcsnicmp (_String1="Wi", _String2="/D", _MaxCount=0x2) returned 72 [0124.614] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xb3e79c | out: lpBuffer="C:\\") returned 0x3 [0124.614] GetFullPathNameW (in: lpFileName="Windows\\System32", nBufferLength=0x104, lpBuffer=0xb3e79c, lpFilePart=0xb3e794 | out: lpBuffer="C:\\Windows\\System32", lpFilePart=0xb3e794*="System32") returned 0x13 [0124.614] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0124.614] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0xb3e518 | out: lpFindFileData=0xb3e518) returned 0xd78380 [0124.614] FindClose (in: hFindFile=0xd78380 | out: hFindFile=0xd78380) returned 1 [0124.614] FindFirstFileW (in: lpFileName="C:\\Windows\\System32", lpFindFileData=0xb3e518 | out: lpFindFileData=0xb3e518) returned 0xd78380 [0124.614] FindClose (in: hFindFile=0xd78380 | out: hFindFile=0xd78380) returned 1 [0124.614] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0124.615] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0124.615] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0124.615] GetEnvironmentStringsW () returned 0xd78380* [0124.615] FreeEnvironmentStringsA (penv="=") returned 1 [0124.615] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xea6720 | out: lpBuffer="C:\\Windows\\System32") returned 0x13 [0124.615] _get_osfhandle (_FileHandle=1) returned 0x3c [0124.615] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0124.697] _get_osfhandle (_FileHandle=1) returned 0x3c [0124.697] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe9e40c | out: lpMode=0xe9e40c) returned 1 [0124.795] _get_osfhandle (_FileHandle=0) returned 0x38 [0124.795] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xe9e408 | out: lpMode=0xe9e408) returned 1 [0124.893] SetConsoleInputExeNameW () returned 0x1 [0124.894] GetConsoleOutputCP () returned 0x1b5 [0124.989] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xe9e460 | out: lpCPInfo=0xe9e460) returned 1 [0124.990] SetThreadUILanguage (LangId=0x0) returned 0x409 [0125.094] CreateFileW (lpFileName="C:\\WinWOW32\\work.bat" (normalized: "c:\\winwow32\\work.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb3f0ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4 [0125.094] _open_osfhandle (_OSFileHandle=0xb4, _Flags=8) returned 3 [0125.094] _get_osfhandle (_FileHandle=3) returned 0xb4 [0125.094] SetFilePointer (in: hFile=0xb4, lDistanceToMove=56, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x38 [0125.094] _get_osfhandle (_FileHandle=3) returned 0xb4 [0125.094] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x38 [0125.094] ReadFile (in: hFile=0xb4, lpBuffer=0xeaa960, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xb3f0bc, lpOverlapped=0x0 | out: lpBuffer=0xeaa960*, lpNumberOfBytesRead=0xb3f0bc*=0x2ea, lpOverlapped=0x0) returned 1 [0125.095] SetFilePointer (in: hFile=0xb4, lDistanceToMove=80, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x50 [0125.095] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xeaa960, cbMultiByte=24, lpWideCharStr=0xe957e0, cchWideChar=8191 | out: lpWideCharStr="takeown /f logonui.exe\r\n\n") returned 24 [0125.095] _get_osfhandle (_FileHandle=3) returned 0xb4 [0125.095] GetFileType (hFile=0xb4) returned 0x1 [0125.095] _get_osfhandle (_FileHandle=3) returned 0xb4 [0125.095] SetFilePointer (in: hFile=0xb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x50 [0125.095] _wcsicmp (_String1="takeown", _String2=")") returned 75 [0125.095] _wcsicmp (_String1="FOR", _String2="takeown") returned -14 [0125.095] _wcsicmp (_String1="FOR/?", _String2="takeown") returned -14 [0125.095] _wcsicmp (_String1="IF", _String2="takeown") returned -11 [0125.095] _wcsicmp (_String1="IF/?", _String2="takeown") returned -11 [0125.095] _wcsicmp (_String1="REM", _String2="takeown") returned -2 [0125.095] _wcsicmp (_String1="REM/?", _String2="takeown") returned -2 [0125.096] _tell (_FileHandle=3) returned 80 [0125.096] _close (_FileHandle=3) returned 0 [0125.096] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0125.096] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0125.096] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0125.096] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0125.096] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0125.096] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0125.096] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0125.096] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0125.096] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0125.096] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0125.096] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0125.096] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0125.096] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0125.097] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0125.097] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0125.097] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0125.097] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0125.097] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0125.097] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0125.097] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0125.097] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0125.097] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0125.097] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0125.097] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0125.097] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0125.097] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0125.097] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0125.097] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0125.097] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0125.097] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0125.097] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0125.097] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0125.097] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0125.097] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0125.097] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0125.097] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0125.097] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0125.097] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0125.097] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0125.097] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0125.097] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0125.097] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0125.097] _wcsnicmp (_String1="take", _String2="cmd ", _MaxCount=0x4) returned 17 [0125.097] SetErrorMode (uMode=0x0) returned 0x0 [0125.097] SetErrorMode (uMode=0x1) returned 0x0 [0125.097] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xd6a158, lpFilePart=0xb3eecc | out: lpBuffer="C:\\Windows\\System32", lpFilePart=0xb3eecc*="System32") returned 0x13 [0125.097] SetErrorMode (uMode=0x0) returned 0x1 [0125.099] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0125.099] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0125.100] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0125.100] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.100] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0xb3ec58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ec58) returned 0xd60f78 [0125.100] FindClose (in: hFindFile=0xd60f78 | out: hFindFile=0xd60f78) returned 1 [0125.100] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0xb3ec58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ec58) returned 0xffffffff [0125.101] GetLastError () returned 0x2 [0125.101] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0xb3ec58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ec58) returned 0xd60f78 [0125.101] FindClose (in: hFindFile=0xd60f78 | out: hFindFile=0xd60f78) returned 1 [0125.101] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0125.101] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0125.101] GetConsoleTitleW (in: lpConsoleTitle=0xb3eca0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0125.185] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0125.185] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0125.185] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0125.185] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0125.185] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0125.185] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0125.185] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0125.185] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0125.185] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0125.185] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0125.185] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0125.185] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0125.185] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0125.185] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0125.185] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0125.185] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0125.185] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0125.185] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0125.185] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0125.185] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0125.185] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0125.185] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0125.185] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0125.185] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0125.185] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0125.185] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0125.185] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0125.185] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0125.185] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0125.185] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0125.185] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0125.185] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0125.185] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0125.185] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0125.185] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0125.185] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0125.185] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0125.185] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0125.185] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0125.185] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0125.185] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0125.185] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0125.185] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0125.186] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0125.186] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0125.186] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0125.186] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0125.186] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0125.186] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0125.186] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0125.186] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0125.186] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0125.186] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0125.186] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0125.186] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0125.186] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0125.186] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0125.186] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0125.186] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0125.186] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0125.186] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0125.186] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0125.186] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0125.186] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0125.186] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0125.186] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0125.186] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0125.186] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0125.186] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0125.186] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0125.186] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0125.186] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0125.186] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0125.186] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0125.186] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0125.186] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0125.186] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0125.186] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0125.186] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0125.186] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0125.186] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0125.186] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0125.186] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0125.186] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0125.186] _wcsicmp (_String1="takeown", _String2="FOR") returned 14 [0125.186] _wcsicmp (_String1="takeown", _String2="IF") returned 11 [0125.186] _wcsicmp (_String1="takeown", _String2="REM") returned 2 [0125.186] _wcsnicmp (_String1="take", _String2="cmd ", _MaxCount=0x4) returned 17 [0125.187] SetErrorMode (uMode=0x0) returned 0x0 [0125.187] SetErrorMode (uMode=0x1) returned 0x0 [0125.187] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xd6a508, lpFilePart=0xb3e7ac | out: lpBuffer="C:\\Windows\\System32", lpFilePart=0xb3e7ac*="System32") returned 0x13 [0125.187] SetErrorMode (uMode=0x0) returned 0x1 [0125.187] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0125.187] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0125.187] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0125.187] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.187] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0xb3e538, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3e538) returned 0xd60fb8 [0125.187] FindClose (in: hFindFile=0xd60fb8 | out: hFindFile=0xd60fb8) returned 1 [0125.187] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0xb3e538, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3e538) returned 0xffffffff [0125.188] GetLastError () returned 0x2 [0125.188] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0xb3e538, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3e538) returned 0xd60fb8 [0125.188] FindClose (in: hFindFile=0xd60fb8 | out: hFindFile=0xd60fb8) returned 1 [0125.188] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0125.188] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0125.188] GetConsoleTitleW (in: lpConsoleTitle=0xb3ea2c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0125.234] InitializeProcThreadAttributeList (in: lpAttributeList=0xb3e958, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xb3e93c | out: lpAttributeList=0xb3e958, lpSize=0xb3e93c) returned 1 [0125.234] UpdateProcThreadAttribute (in: lpAttributeList=0xb3e958, dwFlags=0x0, Attribute=0x60001, lpValue=0xb3e944, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xb3e958, lpPreviousValue=0x0) returned 1 [0125.234] GetStartupInfoW (in: lpStartupInfo=0xb3e990 | out: lpStartupInfo=0xb3e990*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0125.234] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0125.235] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0125.236] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\takeown.exe", lpCommandLine="takeown /f logonui.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\System32", lpStartupInfo=0xb3e8e0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /f logonui.exe", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb3e92c | out: lpCommandLine="takeown /f logonui.exe", lpProcessInformation=0xb3e92c*(hProcess=0xb8, hThread=0xb0, dwProcessId=0xb04, dwThreadId=0x92c)) returned 1 [0125.603] CloseHandle (hObject=0xb0) returned 1 [0125.603] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0125.603] GetEnvironmentStringsW () returned 0xd785e8* [0125.603] FreeEnvironmentStringsA (penv="=") returned 1 [0125.603] WaitForSingleObject (hHandle=0xb8, dwMilliseconds=0xffffffff) returned 0x0 [0126.140] GetExitCodeProcess (in: hProcess=0xb8, lpExitCode=0xb3e8c4 | out: lpExitCode=0xb3e8c4*=0x1) returned 1 [0126.140] CloseHandle (hObject=0xb8) returned 1 [0126.140] _vsnwprintf (in: _Buffer=0xb3e9ac, _BufferCount=0x13, _Format="%08X", _ArgList=0xb3e8cc | out: _Buffer="00000001") returned 8 [0126.140] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0126.140] GetEnvironmentStringsW () returned 0xd785e8* [0126.140] FreeEnvironmentStringsA (penv="=") returned 1 [0126.140] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0126.140] GetEnvironmentStringsW () returned 0xd785e8* [0126.140] FreeEnvironmentStringsA (penv="=") returned 1 [0126.141] DeleteProcThreadAttributeList (in: lpAttributeList=0xb3e958 | out: lpAttributeList=0xb3e958) [0126.141] _get_osfhandle (_FileHandle=1) returned 0x3c [0126.141] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0126.213] _get_osfhandle (_FileHandle=1) returned 0x3c [0126.213] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe9e40c | out: lpMode=0xe9e40c) returned 1 [0126.290] _get_osfhandle (_FileHandle=0) returned 0x38 [0126.290] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xe9e408 | out: lpMode=0xe9e408) returned 1 [0126.391] SetConsoleInputExeNameW () returned 0x1 [0126.391] GetConsoleOutputCP () returned 0x1b5 [0126.480] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xe9e460 | out: lpCPInfo=0xe9e460) returned 1 [0126.480] SetThreadUILanguage (LangId=0x0) returned 0x409 [0126.565] CreateFileW (lpFileName="C:\\WinWOW32\\work.bat" (normalized: "c:\\winwow32\\work.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb3f0ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0126.565] _open_osfhandle (_OSFileHandle=0xb8, _Flags=8) returned 3 [0126.565] _get_osfhandle (_FileHandle=3) returned 0xb8 [0126.565] SetFilePointer (in: hFile=0xb8, lDistanceToMove=80, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x50 [0126.566] _get_osfhandle (_FileHandle=3) returned 0xb8 [0126.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x50 [0126.566] ReadFile (in: hFile=0xb8, lpBuffer=0xeaa960, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xb3f0bc, lpOverlapped=0x0 | out: lpBuffer=0xeaa960*, lpNumberOfBytesRead=0xb3f0bc*=0x2d2, lpOverlapped=0x0) returned 1 [0126.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=122, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a [0126.566] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xeaa960, cbMultiByte=42, lpWideCharStr=0xe957e0, cchWideChar=8191 | out: lpWideCharStr="icacls logonui.exe /granted %username%:F\r\n") returned 42 [0126.566] _get_osfhandle (_FileHandle=3) returned 0xb8 [0126.566] GetFileType (hFile=0xb8) returned 0x1 [0126.566] _get_osfhandle (_FileHandle=3) returned 0xb8 [0126.566] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7a [0126.567] GetEnvironmentVariableW (in: lpName="username", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="CIiHmnxMn6Ps") returned 0xc [0126.567] _wcsicmp (_String1="icacls", _String2=")") returned 64 [0126.567] _wcsicmp (_String1="FOR", _String2="icacls") returned -3 [0126.567] _wcsicmp (_String1="FOR/?", _String2="icacls") returned -3 [0126.567] _wcsicmp (_String1="IF", _String2="icacls") returned 3 [0126.567] _wcsicmp (_String1="IF/?", _String2="icacls") returned 3 [0126.567] _wcsicmp (_String1="REM", _String2="icacls") returned 9 [0126.567] _wcsicmp (_String1="REM/?", _String2="icacls") returned 9 [0126.568] _tell (_FileHandle=3) returned 122 [0126.568] _close (_FileHandle=3) returned 0 [0126.568] _wcsicmp (_String1="icacls", _String2="DIR") returned 5 [0126.568] _wcsicmp (_String1="icacls", _String2="ERASE") returned 4 [0126.568] _wcsicmp (_String1="icacls", _String2="DEL") returned 5 [0126.568] _wcsicmp (_String1="icacls", _String2="TYPE") returned -11 [0126.568] _wcsicmp (_String1="icacls", _String2="COPY") returned 6 [0126.568] _wcsicmp (_String1="icacls", _String2="CD") returned 6 [0126.568] _wcsicmp (_String1="icacls", _String2="CHDIR") returned 6 [0126.568] _wcsicmp (_String1="icacls", _String2="RENAME") returned -9 [0126.568] _wcsicmp (_String1="icacls", _String2="REN") returned -9 [0126.568] _wcsicmp (_String1="icacls", _String2="ECHO") returned 4 [0126.568] _wcsicmp (_String1="icacls", _String2="SET") returned -10 [0126.568] _wcsicmp (_String1="icacls", _String2="PAUSE") returned -7 [0126.569] _wcsicmp (_String1="icacls", _String2="DATE") returned 5 [0126.569] _wcsicmp (_String1="icacls", _String2="TIME") returned -11 [0126.569] _wcsicmp (_String1="icacls", _String2="PROMPT") returned -7 [0126.569] _wcsicmp (_String1="icacls", _String2="MD") returned -4 [0126.569] _wcsicmp (_String1="icacls", _String2="MKDIR") returned -4 [0126.569] _wcsicmp (_String1="icacls", _String2="RD") returned -9 [0126.569] _wcsicmp (_String1="icacls", _String2="RMDIR") returned -9 [0126.569] _wcsicmp (_String1="icacls", _String2="PATH") returned -7 [0126.569] _wcsicmp (_String1="icacls", _String2="GOTO") returned 2 [0126.569] _wcsicmp (_String1="icacls", _String2="SHIFT") returned -10 [0126.569] _wcsicmp (_String1="icacls", _String2="CLS") returned 6 [0126.569] _wcsicmp (_String1="icacls", _String2="CALL") returned 6 [0126.569] _wcsicmp (_String1="icacls", _String2="VERIFY") returned -13 [0126.569] _wcsicmp (_String1="icacls", _String2="VER") returned -13 [0126.569] _wcsicmp (_String1="icacls", _String2="VOL") returned -13 [0126.569] _wcsicmp (_String1="icacls", _String2="EXIT") returned 4 [0126.569] _wcsicmp (_String1="icacls", _String2="SETLOCAL") returned -10 [0126.569] _wcsicmp (_String1="icacls", _String2="ENDLOCAL") returned 4 [0126.569] _wcsicmp (_String1="icacls", _String2="TITLE") returned -11 [0126.569] _wcsicmp (_String1="icacls", _String2="START") returned -10 [0126.569] _wcsicmp (_String1="icacls", _String2="DPATH") returned 5 [0126.569] _wcsicmp (_String1="icacls", _String2="KEYS") returned -2 [0126.569] _wcsicmp (_String1="icacls", _String2="MOVE") returned -4 [0126.569] _wcsicmp (_String1="icacls", _String2="PUSHD") returned -7 [0126.569] _wcsicmp (_String1="icacls", _String2="POPD") returned -7 [0126.569] _wcsicmp (_String1="icacls", _String2="ASSOC") returned 8 [0126.569] _wcsicmp (_String1="icacls", _String2="FTYPE") returned 3 [0126.569] _wcsicmp (_String1="icacls", _String2="BREAK") returned 7 [0126.569] _wcsicmp (_String1="icacls", _String2="COLOR") returned 6 [0126.569] _wcsicmp (_String1="icacls", _String2="MKLINK") returned -4 [0126.569] _wcsnicmp (_String1="icac", _String2="cmd ", _MaxCount=0x4) returned 6 [0126.569] SetErrorMode (uMode=0x0) returned 0x0 [0126.569] SetErrorMode (uMode=0x1) returned 0x0 [0126.569] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xd785f0, lpFilePart=0xb3eecc | out: lpBuffer="C:\\Windows\\System32", lpFilePart=0xb3eecc*="System32") returned 0x13 [0126.569] SetErrorMode (uMode=0x0) returned 0x1 [0126.569] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0126.569] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0126.570] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0126.570] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0126.570] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\icacls.*", fInfoLevelId=0x1, lpFindFileData=0xb3ec58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ec58) returned 0xd60fe8 [0126.570] FindClose (in: hFindFile=0xd60fe8 | out: hFindFile=0xd60fe8) returned 1 [0126.571] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\icacls.COM", fInfoLevelId=0x1, lpFindFileData=0xb3ec58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ec58) returned 0xffffffff [0126.571] GetLastError () returned 0x2 [0126.571] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\icacls.EXE", fInfoLevelId=0x1, lpFindFileData=0xb3ec58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ec58) returned 0xd60fe8 [0126.571] FindClose (in: hFindFile=0xd60fe8 | out: hFindFile=0xd60fe8) returned 1 [0126.571] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0126.571] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0126.571] GetConsoleTitleW (in: lpConsoleTitle=0xb3eca0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0126.648] _wcsicmp (_String1="icacls", _String2="DIR") returned 5 [0126.648] _wcsicmp (_String1="icacls", _String2="ERASE") returned 4 [0126.648] _wcsicmp (_String1="icacls", _String2="DEL") returned 5 [0126.648] _wcsicmp (_String1="icacls", _String2="TYPE") returned -11 [0126.648] _wcsicmp (_String1="icacls", _String2="COPY") returned 6 [0126.648] _wcsicmp (_String1="icacls", _String2="CD") returned 6 [0126.648] _wcsicmp (_String1="icacls", _String2="CHDIR") returned 6 [0126.648] _wcsicmp (_String1="icacls", _String2="RENAME") returned -9 [0126.648] _wcsicmp (_String1="icacls", _String2="REN") returned -9 [0126.648] _wcsicmp (_String1="icacls", _String2="ECHO") returned 4 [0126.648] _wcsicmp (_String1="icacls", _String2="SET") returned -10 [0126.648] _wcsicmp (_String1="icacls", _String2="PAUSE") returned -7 [0126.648] _wcsicmp (_String1="icacls", _String2="DATE") returned 5 [0126.648] _wcsicmp (_String1="icacls", _String2="TIME") returned -11 [0126.648] _wcsicmp (_String1="icacls", _String2="PROMPT") returned -7 [0126.648] _wcsicmp (_String1="icacls", _String2="MD") returned -4 [0126.648] _wcsicmp (_String1="icacls", _String2="MKDIR") returned -4 [0126.649] _wcsicmp (_String1="icacls", _String2="RD") returned -9 [0126.649] _wcsicmp (_String1="icacls", _String2="RMDIR") returned -9 [0126.649] _wcsicmp (_String1="icacls", _String2="PATH") returned -7 [0126.649] _wcsicmp (_String1="icacls", _String2="GOTO") returned 2 [0126.649] _wcsicmp (_String1="icacls", _String2="SHIFT") returned -10 [0126.649] _wcsicmp (_String1="icacls", _String2="CLS") returned 6 [0126.649] _wcsicmp (_String1="icacls", _String2="CALL") returned 6 [0126.649] _wcsicmp (_String1="icacls", _String2="VERIFY") returned -13 [0126.649] _wcsicmp (_String1="icacls", _String2="VER") returned -13 [0126.649] _wcsicmp (_String1="icacls", _String2="VOL") returned -13 [0126.649] _wcsicmp (_String1="icacls", _String2="EXIT") returned 4 [0126.649] _wcsicmp (_String1="icacls", _String2="SETLOCAL") returned -10 [0126.649] _wcsicmp (_String1="icacls", _String2="ENDLOCAL") returned 4 [0126.649] _wcsicmp (_String1="icacls", _String2="TITLE") returned -11 [0126.649] _wcsicmp (_String1="icacls", _String2="START") returned -10 [0126.649] _wcsicmp (_String1="icacls", _String2="DPATH") returned 5 [0126.649] _wcsicmp (_String1="icacls", _String2="KEYS") returned -2 [0126.649] _wcsicmp (_String1="icacls", _String2="MOVE") returned -4 [0126.649] _wcsicmp (_String1="icacls", _String2="PUSHD") returned -7 [0126.649] _wcsicmp (_String1="icacls", _String2="POPD") returned -7 [0126.649] _wcsicmp (_String1="icacls", _String2="ASSOC") returned 8 [0126.649] _wcsicmp (_String1="icacls", _String2="FTYPE") returned 3 [0126.649] _wcsicmp (_String1="icacls", _String2="BREAK") returned 7 [0126.649] _wcsicmp (_String1="icacls", _String2="COLOR") returned 6 [0126.649] _wcsicmp (_String1="icacls", _String2="MKLINK") returned -4 [0126.649] _wcsicmp (_String1="icacls", _String2="DIR") returned 5 [0126.649] _wcsicmp (_String1="icacls", _String2="ERASE") returned 4 [0126.649] _wcsicmp (_String1="icacls", _String2="DEL") returned 5 [0126.649] _wcsicmp (_String1="icacls", _String2="TYPE") returned -11 [0126.649] _wcsicmp (_String1="icacls", _String2="COPY") returned 6 [0126.649] _wcsicmp (_String1="icacls", _String2="CD") returned 6 [0126.649] _wcsicmp (_String1="icacls", _String2="CHDIR") returned 6 [0126.649] _wcsicmp (_String1="icacls", _String2="RENAME") returned -9 [0126.649] _wcsicmp (_String1="icacls", _String2="REN") returned -9 [0126.649] _wcsicmp (_String1="icacls", _String2="ECHO") returned 4 [0126.649] _wcsicmp (_String1="icacls", _String2="SET") returned -10 [0126.649] _wcsicmp (_String1="icacls", _String2="PAUSE") returned -7 [0126.649] _wcsicmp (_String1="icacls", _String2="DATE") returned 5 [0126.649] _wcsicmp (_String1="icacls", _String2="TIME") returned -11 [0126.649] _wcsicmp (_String1="icacls", _String2="PROMPT") returned -7 [0126.649] _wcsicmp (_String1="icacls", _String2="MD") returned -4 [0126.649] _wcsicmp (_String1="icacls", _String2="MKDIR") returned -4 [0126.649] _wcsicmp (_String1="icacls", _String2="RD") returned -9 [0126.649] _wcsicmp (_String1="icacls", _String2="RMDIR") returned -9 [0126.649] _wcsicmp (_String1="icacls", _String2="PATH") returned -7 [0126.649] _wcsicmp (_String1="icacls", _String2="GOTO") returned 2 [0126.649] _wcsicmp (_String1="icacls", _String2="SHIFT") returned -10 [0126.650] _wcsicmp (_String1="icacls", _String2="CLS") returned 6 [0126.650] _wcsicmp (_String1="icacls", _String2="CALL") returned 6 [0126.650] _wcsicmp (_String1="icacls", _String2="VERIFY") returned -13 [0126.650] _wcsicmp (_String1="icacls", _String2="VER") returned -13 [0126.650] _wcsicmp (_String1="icacls", _String2="VOL") returned -13 [0126.650] _wcsicmp (_String1="icacls", _String2="EXIT") returned 4 [0126.650] _wcsicmp (_String1="icacls", _String2="SETLOCAL") returned -10 [0126.650] _wcsicmp (_String1="icacls", _String2="ENDLOCAL") returned 4 [0126.650] _wcsicmp (_String1="icacls", _String2="TITLE") returned -11 [0126.650] _wcsicmp (_String1="icacls", _String2="START") returned -10 [0126.650] _wcsicmp (_String1="icacls", _String2="DPATH") returned 5 [0126.650] _wcsicmp (_String1="icacls", _String2="KEYS") returned -2 [0126.650] _wcsicmp (_String1="icacls", _String2="MOVE") returned -4 [0126.650] _wcsicmp (_String1="icacls", _String2="PUSHD") returned -7 [0126.650] _wcsicmp (_String1="icacls", _String2="POPD") returned -7 [0126.650] _wcsicmp (_String1="icacls", _String2="ASSOC") returned 8 [0126.650] _wcsicmp (_String1="icacls", _String2="FTYPE") returned 3 [0126.650] _wcsicmp (_String1="icacls", _String2="BREAK") returned 7 [0126.650] _wcsicmp (_String1="icacls", _String2="COLOR") returned 6 [0126.650] _wcsicmp (_String1="icacls", _String2="MKLINK") returned -4 [0126.650] _wcsicmp (_String1="icacls", _String2="FOR") returned 3 [0126.650] _wcsicmp (_String1="icacls", _String2="IF") returned -3 [0126.650] _wcsicmp (_String1="icacls", _String2="REM") returned -9 [0126.651] _wcsnicmp (_String1="icac", _String2="cmd ", _MaxCount=0x4) returned 6 [0126.651] SetErrorMode (uMode=0x0) returned 0x0 [0126.651] SetErrorMode (uMode=0x1) returned 0x0 [0126.652] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xd78850, lpFilePart=0xb3e7ac | out: lpBuffer="C:\\Windows\\System32", lpFilePart=0xb3e7ac*="System32") returned 0x13 [0126.652] SetErrorMode (uMode=0x0) returned 0x1 [0126.652] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0126.652] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0126.652] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0126.652] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0126.652] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\icacls.*", fInfoLevelId=0x1, lpFindFileData=0xb3e538, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3e538) returned 0xd60fe8 [0126.652] FindClose (in: hFindFile=0xd60fe8 | out: hFindFile=0xd60fe8) returned 1 [0126.652] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\icacls.COM", fInfoLevelId=0x1, lpFindFileData=0xb3e538, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3e538) returned 0xffffffff [0126.653] GetLastError () returned 0x2 [0126.653] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\icacls.EXE", fInfoLevelId=0x1, lpFindFileData=0xb3e538, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3e538) returned 0xd60fe8 [0126.653] FindClose (in: hFindFile=0xd60fe8 | out: hFindFile=0xd60fe8) returned 1 [0126.653] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0126.653] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0126.653] GetConsoleTitleW (in: lpConsoleTitle=0xb3ea2c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0126.733] InitializeProcThreadAttributeList (in: lpAttributeList=0xb3e958, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xb3e93c | out: lpAttributeList=0xb3e958, lpSize=0xb3e93c) returned 1 [0126.733] UpdateProcThreadAttribute (in: lpAttributeList=0xb3e958, dwFlags=0x0, Attribute=0x60001, lpValue=0xb3e944, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xb3e958, lpPreviousValue=0x0) returned 1 [0126.733] GetStartupInfoW (in: lpStartupInfo=0xb3e990 | out: lpStartupInfo=0xb3e990*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0126.733] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0126.733] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0126.733] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0126.733] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0126.733] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0126.733] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0126.733] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0126.733] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0126.733] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0126.733] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0126.733] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0126.734] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0126.734] lstrcmpW (lpString1="\\icacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0126.734] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\icacls.exe", lpCommandLine="icacls logonui.exe /granted CIiHmnxMn6Ps:F", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\System32", lpStartupInfo=0xb3e8e0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="icacls logonui.exe /granted CIiHmnxMn6Ps:F", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb3e92c | out: lpCommandLine="icacls logonui.exe /granted CIiHmnxMn6Ps:F", lpProcessInformation=0xb3e92c*(hProcess=0xb0, hThread=0xb8, dwProcessId=0x554, dwThreadId=0x2c4)) returned 1 [0127.054] CloseHandle (hObject=0xb8) returned 1 [0127.054] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0127.054] GetEnvironmentStringsW () returned 0xd6b438* [0127.054] FreeEnvironmentStringsA (penv="=") returned 1 [0127.054] WaitForSingleObject (hHandle=0xb0, dwMilliseconds=0xffffffff) returned 0x0 [0127.660] GetExitCodeProcess (in: hProcess=0xb0, lpExitCode=0xb3e8c4 | out: lpExitCode=0xb3e8c4*=0x2) returned 1 [0127.660] CloseHandle (hObject=0xb0) returned 1 [0127.660] _vsnwprintf (in: _Buffer=0xb3e9ac, _BufferCount=0x13, _Format="%08X", _ArgList=0xb3e8cc | out: _Buffer="00000002") returned 8 [0127.660] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0127.660] GetEnvironmentStringsW () returned 0xd6b438* [0127.660] FreeEnvironmentStringsA (penv="=") returned 1 [0127.660] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0127.660] GetEnvironmentStringsW () returned 0xd6b438* [0127.660] FreeEnvironmentStringsA (penv="=") returned 1 [0127.660] DeleteProcThreadAttributeList (in: lpAttributeList=0xb3e958 | out: lpAttributeList=0xb3e958) [0127.660] _get_osfhandle (_FileHandle=1) returned 0x3c [0127.660] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0127.741] _get_osfhandle (_FileHandle=1) returned 0x3c [0127.741] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe9e40c | out: lpMode=0xe9e40c) returned 1 [0127.825] _get_osfhandle (_FileHandle=0) returned 0x38 [0127.825] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xe9e408 | out: lpMode=0xe9e408) returned 1 [0127.906] SetConsoleInputExeNameW () returned 0x1 [0127.906] GetConsoleOutputCP () returned 0x1b5 [0127.989] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xe9e460 | out: lpCPInfo=0xe9e460) returned 1 [0127.989] SetThreadUILanguage (LangId=0x0) returned 0x409 [0128.064] CreateFileW (lpFileName="C:\\WinWOW32\\work.bat" (normalized: "c:\\winwow32\\work.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb3f0ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb0 [0128.064] _open_osfhandle (_OSFileHandle=0xb0, _Flags=8) returned 3 [0128.064] _get_osfhandle (_FileHandle=3) returned 0xb0 [0128.064] SetFilePointer (in: hFile=0xb0, lDistanceToMove=122, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7a [0128.065] _get_osfhandle (_FileHandle=3) returned 0xb0 [0128.065] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7a [0128.065] ReadFile (in: hFile=0xb0, lpBuffer=0xeaa960, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xb3f0bc, lpOverlapped=0x0 | out: lpBuffer=0xeaa960*, lpNumberOfBytesRead=0xb3f0bc*=0x2a8, lpOverlapped=0x0) returned 1 [0128.065] SetFilePointer (in: hFile=0xb0, lDistanceToMove=170, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaa [0128.065] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xeaa960, cbMultiByte=48, lpWideCharStr=0xe957e0, cchWideChar=8191 | out: lpWideCharStr="takeown /f \"C:\\Windows\\System32\\en-US\" /r /d y\r\n") returned 48 [0128.065] _get_osfhandle (_FileHandle=3) returned 0xb0 [0128.065] GetFileType (hFile=0xb0) returned 0x1 [0128.065] _get_osfhandle (_FileHandle=3) returned 0xb0 [0128.065] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xaa [0128.065] _wcsicmp (_String1="takeown", _String2=")") returned 75 [0128.065] _wcsicmp (_String1="FOR", _String2="takeown") returned -14 [0128.065] _wcsicmp (_String1="FOR/?", _String2="takeown") returned -14 [0128.065] _wcsicmp (_String1="IF", _String2="takeown") returned -11 [0128.065] _wcsicmp (_String1="IF/?", _String2="takeown") returned -11 [0128.065] _wcsicmp (_String1="REM", _String2="takeown") returned -2 [0128.065] _wcsicmp (_String1="REM/?", _String2="takeown") returned -2 [0128.066] _tell (_FileHandle=3) returned 170 [0128.066] _close (_FileHandle=3) returned 0 [0128.066] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0128.066] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0128.066] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0128.066] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0128.066] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0128.066] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0128.066] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0128.066] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0128.066] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0128.066] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0128.066] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0128.066] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0128.067] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0128.067] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0128.067] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0128.067] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0128.067] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0128.067] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0128.067] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0128.067] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0128.067] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0128.067] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0128.067] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0128.067] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0128.067] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0128.067] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0128.067] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0128.067] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0128.067] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0128.067] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0128.067] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0128.067] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0128.067] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0128.067] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0128.067] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0128.067] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0128.067] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0128.067] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0128.067] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0128.067] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0128.067] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0128.067] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0128.067] _wcsnicmp (_String1="take", _String2="cmd ", _MaxCount=0x4) returned 17 [0128.067] SetErrorMode (uMode=0x0) returned 0x0 [0128.067] SetErrorMode (uMode=0x1) returned 0x0 [0128.067] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xd6b440, lpFilePart=0xb3eecc | out: lpBuffer="C:\\Windows\\System32", lpFilePart=0xb3eecc*="System32") returned 0x13 [0128.067] SetErrorMode (uMode=0x0) returned 0x1 [0128.067] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0128.067] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0128.068] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0128.068] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0128.068] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0xb3ec58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ec58) returned 0xd623e8 [0128.068] FindClose (in: hFindFile=0xd623e8 | out: hFindFile=0xd623e8) returned 1 [0128.068] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0xb3ec58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ec58) returned 0xffffffff [0128.068] GetLastError () returned 0x2 [0128.068] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0xb3ec58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ec58) returned 0xd623e8 [0128.068] FindClose (in: hFindFile=0xd623e8 | out: hFindFile=0xd623e8) returned 1 [0128.069] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0128.069] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0128.069] GetConsoleTitleW (in: lpConsoleTitle=0xb3eca0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0128.144] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0128.144] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0128.144] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0128.144] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0128.144] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0128.144] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0128.144] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0128.144] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0128.144] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0128.144] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0128.144] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0128.144] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0128.144] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0128.144] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0128.145] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0128.145] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0128.145] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0128.145] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0128.145] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0128.145] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0128.145] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0128.145] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0128.145] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0128.145] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0128.145] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0128.145] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0128.145] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0128.145] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0128.145] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0128.145] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0128.145] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0128.145] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0128.145] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0128.145] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0128.145] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0128.145] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0128.145] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0128.145] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0128.145] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0128.145] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0128.145] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0128.145] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0128.145] _wcsicmp (_String1="takeown", _String2="DIR") returned 16 [0128.145] _wcsicmp (_String1="takeown", _String2="ERASE") returned 15 [0128.145] _wcsicmp (_String1="takeown", _String2="DEL") returned 16 [0128.145] _wcsicmp (_String1="takeown", _String2="TYPE") returned -24 [0128.145] _wcsicmp (_String1="takeown", _String2="COPY") returned 17 [0128.145] _wcsicmp (_String1="takeown", _String2="CD") returned 17 [0128.145] _wcsicmp (_String1="takeown", _String2="CHDIR") returned 17 [0128.145] _wcsicmp (_String1="takeown", _String2="RENAME") returned 2 [0128.145] _wcsicmp (_String1="takeown", _String2="REN") returned 2 [0128.145] _wcsicmp (_String1="takeown", _String2="ECHO") returned 15 [0128.145] _wcsicmp (_String1="takeown", _String2="SET") returned 1 [0128.145] _wcsicmp (_String1="takeown", _String2="PAUSE") returned 4 [0128.145] _wcsicmp (_String1="takeown", _String2="DATE") returned 16 [0128.145] _wcsicmp (_String1="takeown", _String2="TIME") returned -8 [0128.145] _wcsicmp (_String1="takeown", _String2="PROMPT") returned 4 [0128.145] _wcsicmp (_String1="takeown", _String2="MD") returned 7 [0128.145] _wcsicmp (_String1="takeown", _String2="MKDIR") returned 7 [0128.145] _wcsicmp (_String1="takeown", _String2="RD") returned 2 [0128.145] _wcsicmp (_String1="takeown", _String2="RMDIR") returned 2 [0128.146] _wcsicmp (_String1="takeown", _String2="PATH") returned 4 [0128.146] _wcsicmp (_String1="takeown", _String2="GOTO") returned 13 [0128.146] _wcsicmp (_String1="takeown", _String2="SHIFT") returned 1 [0128.146] _wcsicmp (_String1="takeown", _String2="CLS") returned 17 [0128.146] _wcsicmp (_String1="takeown", _String2="CALL") returned 17 [0128.146] _wcsicmp (_String1="takeown", _String2="VERIFY") returned -2 [0128.146] _wcsicmp (_String1="takeown", _String2="VER") returned -2 [0128.146] _wcsicmp (_String1="takeown", _String2="VOL") returned -2 [0128.146] _wcsicmp (_String1="takeown", _String2="EXIT") returned 15 [0128.146] _wcsicmp (_String1="takeown", _String2="SETLOCAL") returned 1 [0128.146] _wcsicmp (_String1="takeown", _String2="ENDLOCAL") returned 15 [0128.146] _wcsicmp (_String1="takeown", _String2="TITLE") returned -8 [0128.146] _wcsicmp (_String1="takeown", _String2="START") returned 1 [0128.146] _wcsicmp (_String1="takeown", _String2="DPATH") returned 16 [0128.146] _wcsicmp (_String1="takeown", _String2="KEYS") returned 9 [0128.146] _wcsicmp (_String1="takeown", _String2="MOVE") returned 7 [0128.146] _wcsicmp (_String1="takeown", _String2="PUSHD") returned 4 [0128.146] _wcsicmp (_String1="takeown", _String2="POPD") returned 4 [0128.146] _wcsicmp (_String1="takeown", _String2="ASSOC") returned 19 [0128.146] _wcsicmp (_String1="takeown", _String2="FTYPE") returned 14 [0128.146] _wcsicmp (_String1="takeown", _String2="BREAK") returned 18 [0128.146] _wcsicmp (_String1="takeown", _String2="COLOR") returned 17 [0128.146] _wcsicmp (_String1="takeown", _String2="MKLINK") returned 7 [0128.146] _wcsicmp (_String1="takeown", _String2="FOR") returned 14 [0128.146] _wcsicmp (_String1="takeown", _String2="IF") returned 11 [0128.146] _wcsicmp (_String1="takeown", _String2="REM") returned 2 [0128.146] _wcsnicmp (_String1="take", _String2="cmd ", _MaxCount=0x4) returned 17 [0128.146] SetErrorMode (uMode=0x0) returned 0x0 [0128.146] SetErrorMode (uMode=0x1) returned 0x0 [0128.146] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xd6b488, lpFilePart=0xb3e7ac | out: lpBuffer="C:\\Windows\\System32", lpFilePart=0xb3e7ac*="System32") returned 0x13 [0128.146] SetErrorMode (uMode=0x0) returned 0x1 [0128.146] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0128.146] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0128.147] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0128.147] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0128.147] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\takeown.*", fInfoLevelId=0x1, lpFindFileData=0xb3e538, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3e538) returned 0xd79ab0 [0128.147] FindClose (in: hFindFile=0xd79ab0 | out: hFindFile=0xd79ab0) returned 1 [0128.147] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\takeown.COM", fInfoLevelId=0x1, lpFindFileData=0xb3e538, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3e538) returned 0xffffffff [0128.147] GetLastError () returned 0x2 [0128.147] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\takeown.EXE", fInfoLevelId=0x1, lpFindFileData=0xb3e538, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3e538) returned 0xd79ab0 [0128.147] FindClose (in: hFindFile=0xd79ab0 | out: hFindFile=0xd79ab0) returned 1 [0128.148] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0128.148] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0128.148] GetConsoleTitleW (in: lpConsoleTitle=0xb3ea2c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0128.230] InitializeProcThreadAttributeList (in: lpAttributeList=0xb3e958, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xb3e93c | out: lpAttributeList=0xb3e958, lpSize=0xb3e93c) returned 1 [0128.230] UpdateProcThreadAttribute (in: lpAttributeList=0xb3e958, dwFlags=0x0, Attribute=0x60001, lpValue=0xb3e944, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xb3e958, lpPreviousValue=0x0) returned 1 [0128.230] GetStartupInfoW (in: lpStartupInfo=0xb3e990 | out: lpStartupInfo=0xb3e990*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0128.230] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0128.230] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0128.230] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0128.230] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0128.230] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0128.230] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0128.230] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0128.230] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0128.230] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0128.230] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0128.230] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0128.230] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0128.231] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0128.231] lstrcmpW (lpString1="\\takeown.exe", lpString2="\\XCOPY.EXE") returned -1 [0128.231] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\takeown.exe", lpCommandLine="takeown /f \"C:\\Windows\\System32\\en-US\" /r /d y", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\System32", lpStartupInfo=0xb3e8e0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="takeown /f \"C:\\Windows\\System32\\en-US\" /r /d y", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb3e92c | out: lpCommandLine="takeown /f \"C:\\Windows\\System32\\en-US\" /r /d y", lpProcessInformation=0xb3e92c*(hProcess=0xb8, hThread=0xb0, dwProcessId=0x8d8, dwThreadId=0xc10)) returned 1 [0128.237] CloseHandle (hObject=0xb0) returned 1 [0128.237] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0128.237] GetEnvironmentStringsW () returned 0xd6b4c8* [0128.237] FreeEnvironmentStringsA (penv="=") returned 1 [0128.237] WaitForSingleObject (hHandle=0xb8, dwMilliseconds=0xffffffff) returned 0x0 [0144.652] GetExitCodeProcess (in: hProcess=0xb8, lpExitCode=0xb3e8c4 | out: lpExitCode=0xb3e8c4*=0x40010004) returned 1 [0144.652] CloseHandle (hObject=0xb8) returned 1 [0144.652] _vsnwprintf (in: _Buffer=0xb3e9ac, _BufferCount=0x13, _Format="%08X", _ArgList=0xb3e8cc | out: _Buffer="40010004") returned 8 [0144.652] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="40010004") returned 1 [0144.652] GetEnvironmentStringsW () returned 0xd6b4c8* [0144.653] FreeEnvironmentStringsA (penv="=") returned 1 [0144.653] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0144.653] GetEnvironmentStringsW () returned 0xd6b4c8* [0144.653] FreeEnvironmentStringsA (penv="=") returned 1 [0144.653] DeleteProcThreadAttributeList (in: lpAttributeList=0xb3e958 | out: lpAttributeList=0xb3e958) [0144.653] _get_osfhandle (_FileHandle=1) returned 0x3c [0144.653] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0144.771] _get_osfhandle (_FileHandle=1) returned 0x3c [0144.771] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe9e40c | out: lpMode=0xe9e40c) returned 1 [0144.771] _get_osfhandle (_FileHandle=0) returned 0x38 [0144.771] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xe9e408 | out: lpMode=0xe9e408) returned 1 [0144.771] SetConsoleInputExeNameW () returned 0x1 [0144.771] GetConsoleOutputCP () returned 0x1b5 [0144.771] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xe9e460 | out: lpCPInfo=0xe9e460) returned 1 [0144.771] SetThreadUILanguage (LangId=0x0) returned 0x409 [0144.772] CreateFileW (lpFileName="C:\\WinWOW32\\work.bat" (normalized: "c:\\winwow32\\work.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb3f0ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8 [0144.772] _open_osfhandle (_OSFileHandle=0xb8, _Flags=8) returned 3 [0144.772] _get_osfhandle (_FileHandle=3) returned 0xb8 [0144.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=170, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xaa [0144.772] _get_osfhandle (_FileHandle=3) returned 0xb8 [0144.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xaa [0144.772] ReadFile (in: hFile=0xb8, lpBuffer=0xeaa960, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xb3f0bc, lpOverlapped=0x0 | out: lpBuffer=0xeaa960*, lpNumberOfBytesRead=0xb3f0bc*=0x278, lpOverlapped=0x0) returned 1 [0144.772] SetFilePointer (in: hFile=0xb8, lDistanceToMove=234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xea [0144.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xeaa960, cbMultiByte=64, lpWideCharStr=0xe957e0, cchWideChar=8191 | out: lpWideCharStr="icacls \"C:\\Windows\\System32\\en-US\" /granted %username%:F /T /C\r\n") returned 64 [0144.772] _get_osfhandle (_FileHandle=3) returned 0xb8 [0144.772] GetFileType (hFile=0xb8) returned 0x1 [0144.773] _get_osfhandle (_FileHandle=3) returned 0xb8 [0144.773] SetFilePointer (in: hFile=0xb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xea [0144.773] GetEnvironmentVariableW (in: lpName="username", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="CIiHmnxMn6Ps") returned 0xc [0144.773] _wcsicmp (_String1="icacls", _String2=")") returned 64 [0144.773] _wcsicmp (_String1="FOR", _String2="icacls") returned -3 [0144.773] _wcsicmp (_String1="FOR/?", _String2="icacls") returned -3 [0144.773] _wcsicmp (_String1="IF", _String2="icacls") returned 3 [0144.773] _wcsicmp (_String1="IF/?", _String2="icacls") returned 3 [0144.773] _wcsicmp (_String1="REM", _String2="icacls") returned 9 [0144.773] _wcsicmp (_String1="REM/?", _String2="icacls") returned 9 [0144.774] _tell (_FileHandle=3) returned 234 [0144.774] _close (_FileHandle=3) returned 0 [0144.774] _wcsicmp (_String1="icacls", _String2="DIR") returned 5 [0144.774] _wcsicmp (_String1="icacls", _String2="ERASE") returned 4 [0144.774] _wcsicmp (_String1="icacls", _String2="DEL") returned 5 [0144.774] _wcsicmp (_String1="icacls", _String2="TYPE") returned -11 [0144.774] _wcsicmp (_String1="icacls", _String2="COPY") returned 6 [0144.774] _wcsicmp (_String1="icacls", _String2="CD") returned 6 [0144.774] _wcsicmp (_String1="icacls", _String2="CHDIR") returned 6 [0144.774] _wcsicmp (_String1="icacls", _String2="RENAME") returned -9 [0144.774] _wcsicmp (_String1="icacls", _String2="REN") returned -9 [0144.774] _wcsicmp (_String1="icacls", _String2="ECHO") returned 4 [0144.774] _wcsicmp (_String1="icacls", _String2="SET") returned -10 [0144.774] _wcsicmp (_String1="icacls", _String2="PAUSE") returned -7 [0144.774] _wcsicmp (_String1="icacls", _String2="DATE") returned 5 [0144.774] _wcsicmp (_String1="icacls", _String2="TIME") returned -11 [0144.774] _wcsicmp (_String1="icacls", _String2="PROMPT") returned -7 [0144.774] _wcsicmp (_String1="icacls", _String2="MD") returned -4 [0144.774] _wcsicmp (_String1="icacls", _String2="MKDIR") returned -4 [0144.774] _wcsicmp (_String1="icacls", _String2="RD") returned -9 [0144.774] _wcsicmp (_String1="icacls", _String2="RMDIR") returned -9 [0144.774] _wcsicmp (_String1="icacls", _String2="PATH") returned -7 [0144.774] _wcsicmp (_String1="icacls", _String2="GOTO") returned 2 [0144.774] _wcsicmp (_String1="icacls", _String2="SHIFT") returned -10 [0144.774] _wcsicmp (_String1="icacls", _String2="CLS") returned 6 [0144.774] _wcsicmp (_String1="icacls", _String2="CALL") returned 6 [0144.774] _wcsicmp (_String1="icacls", _String2="VERIFY") returned -13 [0144.774] _wcsicmp (_String1="icacls", _String2="VER") returned -13 [0144.774] _wcsicmp (_String1="icacls", _String2="VOL") returned -13 [0144.774] _wcsicmp (_String1="icacls", _String2="EXIT") returned 4 [0144.774] _wcsicmp (_String1="icacls", _String2="SETLOCAL") returned -10 [0144.774] _wcsicmp (_String1="icacls", _String2="ENDLOCAL") returned 4 [0144.774] _wcsicmp (_String1="icacls", _String2="TITLE") returned -11 [0144.774] _wcsicmp (_String1="icacls", _String2="START") returned -10 [0144.774] _wcsicmp (_String1="icacls", _String2="DPATH") returned 5 [0144.774] _wcsicmp (_String1="icacls", _String2="KEYS") returned -2 [0144.774] _wcsicmp (_String1="icacls", _String2="MOVE") returned -4 [0144.774] _wcsicmp (_String1="icacls", _String2="PUSHD") returned -7 [0144.775] _wcsicmp (_String1="icacls", _String2="POPD") returned -7 [0144.775] _wcsicmp (_String1="icacls", _String2="ASSOC") returned 8 [0144.775] _wcsicmp (_String1="icacls", _String2="FTYPE") returned 3 [0144.775] _wcsicmp (_String1="icacls", _String2="BREAK") returned 7 [0144.775] _wcsicmp (_String1="icacls", _String2="COLOR") returned 6 [0144.775] _wcsicmp (_String1="icacls", _String2="MKLINK") returned -4 [0144.775] _wcsnicmp (_String1="icac", _String2="cmd ", _MaxCount=0x4) returned 6 [0144.775] SetErrorMode (uMode=0x0) returned 0x0 [0144.775] SetErrorMode (uMode=0x1) returned 0x0 [0144.775] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xd6b440, lpFilePart=0xb3eecc | out: lpBuffer="C:\\Windows\\System32", lpFilePart=0xb3eecc*="System32") returned 0x13 [0144.775] SetErrorMode (uMode=0x0) returned 0x1 [0144.775] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0144.775] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0144.775] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0144.775] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0144.775] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\icacls.*", fInfoLevelId=0x1, lpFindFileData=0xb3ec58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ec58) returned 0xd62390 [0144.775] FindClose (in: hFindFile=0xd62390 | out: hFindFile=0xd62390) returned 1 [0144.776] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\icacls.COM", fInfoLevelId=0x1, lpFindFileData=0xb3ec58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ec58) returned 0xffffffff [0144.776] GetLastError () returned 0x2 [0144.776] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\icacls.EXE", fInfoLevelId=0x1, lpFindFileData=0xb3ec58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3ec58) returned 0xd62390 [0144.776] FindClose (in: hFindFile=0xd62390 | out: hFindFile=0xd62390) returned 1 [0144.776] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0144.776] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0144.776] GetConsoleTitleW (in: lpConsoleTitle=0xb3eca0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0144.776] _wcsicmp (_String1="icacls", _String2="DIR") returned 5 [0144.776] _wcsicmp (_String1="icacls", _String2="ERASE") returned 4 [0144.776] _wcsicmp (_String1="icacls", _String2="DEL") returned 5 [0144.776] _wcsicmp (_String1="icacls", _String2="TYPE") returned -11 [0144.776] _wcsicmp (_String1="icacls", _String2="COPY") returned 6 [0144.776] _wcsicmp (_String1="icacls", _String2="CD") returned 6 [0144.776] _wcsicmp (_String1="icacls", _String2="CHDIR") returned 6 [0144.776] _wcsicmp (_String1="icacls", _String2="RENAME") returned -9 [0144.776] _wcsicmp (_String1="icacls", _String2="REN") returned -9 [0144.776] _wcsicmp (_String1="icacls", _String2="ECHO") returned 4 [0144.776] _wcsicmp (_String1="icacls", _String2="SET") returned -10 [0144.776] _wcsicmp (_String1="icacls", _String2="PAUSE") returned -7 [0144.776] _wcsicmp (_String1="icacls", _String2="DATE") returned 5 [0144.776] _wcsicmp (_String1="icacls", _String2="TIME") returned -11 [0144.776] _wcsicmp (_String1="icacls", _String2="PROMPT") returned -7 [0144.776] _wcsicmp (_String1="icacls", _String2="MD") returned -4 [0144.776] _wcsicmp (_String1="icacls", _String2="MKDIR") returned -4 [0144.776] _wcsicmp (_String1="icacls", _String2="RD") returned -9 [0144.776] _wcsicmp (_String1="icacls", _String2="RMDIR") returned -9 [0144.777] _wcsicmp (_String1="icacls", _String2="PATH") returned -7 [0144.777] _wcsicmp (_String1="icacls", _String2="GOTO") returned 2 [0144.777] _wcsicmp (_String1="icacls", _String2="SHIFT") returned -10 [0144.777] _wcsicmp (_String1="icacls", _String2="CLS") returned 6 [0144.777] _wcsicmp (_String1="icacls", _String2="CALL") returned 6 [0144.777] _wcsicmp (_String1="icacls", _String2="VERIFY") returned -13 [0144.777] _wcsicmp (_String1="icacls", _String2="VER") returned -13 [0144.777] _wcsicmp (_String1="icacls", _String2="VOL") returned -13 [0144.777] _wcsicmp (_String1="icacls", _String2="EXIT") returned 4 [0144.777] _wcsicmp (_String1="icacls", _String2="SETLOCAL") returned -10 [0144.777] _wcsicmp (_String1="icacls", _String2="ENDLOCAL") returned 4 [0144.777] _wcsicmp (_String1="icacls", _String2="TITLE") returned -11 [0144.777] _wcsicmp (_String1="icacls", _String2="START") returned -10 [0144.777] _wcsicmp (_String1="icacls", _String2="DPATH") returned 5 [0144.777] _wcsicmp (_String1="icacls", _String2="KEYS") returned -2 [0144.777] _wcsicmp (_String1="icacls", _String2="MOVE") returned -4 [0144.777] _wcsicmp (_String1="icacls", _String2="PUSHD") returned -7 [0144.777] _wcsicmp (_String1="icacls", _String2="POPD") returned -7 [0144.777] _wcsicmp (_String1="icacls", _String2="ASSOC") returned 8 [0144.777] _wcsicmp (_String1="icacls", _String2="FTYPE") returned 3 [0144.777] _wcsicmp (_String1="icacls", _String2="BREAK") returned 7 [0144.777] _wcsicmp (_String1="icacls", _String2="COLOR") returned 6 [0144.777] _wcsicmp (_String1="icacls", _String2="MKLINK") returned -4 [0144.777] _wcsicmp (_String1="icacls", _String2="DIR") returned 5 [0144.777] _wcsicmp (_String1="icacls", _String2="ERASE") returned 4 [0144.777] _wcsicmp (_String1="icacls", _String2="DEL") returned 5 [0144.777] _wcsicmp (_String1="icacls", _String2="TYPE") returned -11 [0144.777] _wcsicmp (_String1="icacls", _String2="COPY") returned 6 [0144.777] _wcsicmp (_String1="icacls", _String2="CD") returned 6 [0144.777] _wcsicmp (_String1="icacls", _String2="CHDIR") returned 6 [0144.777] _wcsicmp (_String1="icacls", _String2="RENAME") returned -9 [0144.777] _wcsicmp (_String1="icacls", _String2="REN") returned -9 [0144.777] _wcsicmp (_String1="icacls", _String2="ECHO") returned 4 [0144.777] _wcsicmp (_String1="icacls", _String2="SET") returned -10 [0144.777] _wcsicmp (_String1="icacls", _String2="PAUSE") returned -7 [0144.777] _wcsicmp (_String1="icacls", _String2="DATE") returned 5 [0144.777] _wcsicmp (_String1="icacls", _String2="TIME") returned -11 [0144.777] _wcsicmp (_String1="icacls", _String2="PROMPT") returned -7 [0144.777] _wcsicmp (_String1="icacls", _String2="MD") returned -4 [0144.777] _wcsicmp (_String1="icacls", _String2="MKDIR") returned -4 [0144.777] _wcsicmp (_String1="icacls", _String2="RD") returned -9 [0144.777] _wcsicmp (_String1="icacls", _String2="RMDIR") returned -9 [0144.777] _wcsicmp (_String1="icacls", _String2="PATH") returned -7 [0144.777] _wcsicmp (_String1="icacls", _String2="GOTO") returned 2 [0144.777] _wcsicmp (_String1="icacls", _String2="SHIFT") returned -10 [0144.777] _wcsicmp (_String1="icacls", _String2="CLS") returned 6 [0144.777] _wcsicmp (_String1="icacls", _String2="CALL") returned 6 [0144.777] _wcsicmp (_String1="icacls", _String2="VERIFY") returned -13 [0144.777] _wcsicmp (_String1="icacls", _String2="VER") returned -13 [0144.777] _wcsicmp (_String1="icacls", _String2="VOL") returned -13 [0144.777] _wcsicmp (_String1="icacls", _String2="EXIT") returned 4 [0144.777] _wcsicmp (_String1="icacls", _String2="SETLOCAL") returned -10 [0144.778] _wcsicmp (_String1="icacls", _String2="ENDLOCAL") returned 4 [0144.778] _wcsicmp (_String1="icacls", _String2="TITLE") returned -11 [0144.778] _wcsicmp (_String1="icacls", _String2="START") returned -10 [0144.778] _wcsicmp (_String1="icacls", _String2="DPATH") returned 5 [0144.778] _wcsicmp (_String1="icacls", _String2="KEYS") returned -2 [0144.778] _wcsicmp (_String1="icacls", _String2="MOVE") returned -4 [0144.778] _wcsicmp (_String1="icacls", _String2="PUSHD") returned -7 [0144.778] _wcsicmp (_String1="icacls", _String2="POPD") returned -7 [0144.778] _wcsicmp (_String1="icacls", _String2="ASSOC") returned 8 [0144.778] _wcsicmp (_String1="icacls", _String2="FTYPE") returned 3 [0144.778] _wcsicmp (_String1="icacls", _String2="BREAK") returned 7 [0144.778] _wcsicmp (_String1="icacls", _String2="COLOR") returned 6 [0144.778] _wcsicmp (_String1="icacls", _String2="MKLINK") returned -4 [0144.778] _wcsicmp (_String1="icacls", _String2="FOR") returned 3 [0144.778] _wcsicmp (_String1="icacls", _String2="IF") returned -3 [0144.778] _wcsicmp (_String1="icacls", _String2="REM") returned -9 [0144.778] _wcsnicmp (_String1="icac", _String2="cmd ", _MaxCount=0x4) returned 6 [0144.778] SetErrorMode (uMode=0x0) returned 0x0 [0144.778] SetErrorMode (uMode=0x1) returned 0x0 [0144.778] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xd6b488, lpFilePart=0xb3e7ac | out: lpBuffer="C:\\Windows\\System32", lpFilePart=0xb3e7ac*="System32") returned 0x13 [0144.778] SetErrorMode (uMode=0x0) returned 0x1 [0144.778] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0144.778] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0144.778] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xe9e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0144.778] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0144.779] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\icacls.*", fInfoLevelId=0x1, lpFindFileData=0xb3e538, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3e538) returned 0xd62390 [0144.779] FindClose (in: hFindFile=0xd62390 | out: hFindFile=0xd62390) returned 1 [0144.779] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\icacls.COM", fInfoLevelId=0x1, lpFindFileData=0xb3e538, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3e538) returned 0xffffffff [0144.779] GetLastError () returned 0x2 [0144.779] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\icacls.EXE", fInfoLevelId=0x1, lpFindFileData=0xb3e538, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb3e538) returned 0xd62390 [0144.779] FindClose (in: hFindFile=0xd62390 | out: hFindFile=0xd62390) returned 1 [0144.779] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0144.779] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0144.779] GetConsoleTitleW (in: lpConsoleTitle=0xb3ea2c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0144.782] InitializeProcThreadAttributeList (in: lpAttributeList=0xb3e958, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xb3e93c | out: lpAttributeList=0xb3e958, lpSize=0xb3e93c) returned 1 [0144.782] UpdateProcThreadAttribute (in: lpAttributeList=0xb3e958, dwFlags=0x0, Attribute=0x60001, lpValue=0xb3e944, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xb3e958, lpPreviousValue=0x0) returned 1 [0144.782] GetStartupInfoW (in: lpStartupInfo=0xb3e990 | out: lpStartupInfo=0xb3e990*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0144.782] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0144.782] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0144.782] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0144.782] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0144.782] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0144.782] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0144.782] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0144.782] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0144.782] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0144.783] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0144.783] lstrcmpW (lpString1="\\icacls.exe", lpString2="\\XCOPY.EXE") returned -1 [0144.783] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\icacls.exe", lpCommandLine="icacls \"C:\\Windows\\System32\\en-US\" /granted CIiHmnxMn6Ps:F /T /C", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\System32", lpStartupInfo=0xb3e8e0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="icacls \"C:\\Windows\\System32\\en-US\" /granted CIiHmnxMn6Ps:F /T /C", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb3e92c | out: lpCommandLine="icacls \"C:\\Windows\\System32\\en-US\" /granted CIiHmnxMn6Ps:F /T /C", lpProcessInformation=0xb3e92c*(hProcess=0xb0, hThread=0xb8, dwProcessId=0x444, dwThreadId=0xd7c)) returned 1 [0144.790] CloseHandle (hObject=0xb8) returned 1 [0144.790] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0144.790] GetEnvironmentStringsW () returned 0xd6b4c8* [0144.790] FreeEnvironmentStringsA (penv="=") returned 1 [0144.790] WaitForSingleObject (hHandle=0xb0, dwMilliseconds=0xffffffff) Thread: id = 16 os_tid = 0xeb0 Thread: id = 25 os_tid = 0xcd4 Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x48ab8000" os_pid = "0xd54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdf4" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013c81" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 336 start_va = 0x7f2b7000 end_va = 0x7f2b7fff entry_point = 0x0 region_type = private name = "private_0x000000007f2b7000" filename = "" Region: id = 337 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 338 start_va = 0x8255f80000 end_va = 0x8255f9ffff entry_point = 0x0 region_type = private name = "private_0x0000008255f80000" filename = "" Region: id = 339 start_va = 0x8255fa0000 end_va = 0x8255fb3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008255fa0000" filename = "" Region: id = 340 start_va = 0x8255fc0000 end_va = 0x8255ffffff entry_point = 0x0 region_type = private name = "private_0x0000008255fc0000" filename = "" Region: id = 341 start_va = 0x7df5ff020000 end_va = 0x7ff5ff01ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff020000" filename = "" Region: id = 342 start_va = 0x7ff7fcde0000 end_va = 0x7ff7fce02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7fcde0000" filename = "" Region: id = 343 start_va = 0x7ff7fce05000 end_va = 0x7ff7fce05fff entry_point = 0x0 region_type = private name = "private_0x00007ff7fce05000" filename = "" Region: id = 344 start_va = 0x7ff7fce0e000 end_va = 0x7ff7fce0ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7fce0e000" filename = "" Region: id = 345 start_va = 0x7ff7fd4c0000 end_va = 0x7ff7fd4d0fff entry_point = 0x7ff7fd4c0000 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 346 start_va = 0x7ffaf7a10000 end_va = 0x7ffaf7bd1fff entry_point = 0x7ffaf7a10000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 347 start_va = 0x8256180000 end_va = 0x825627ffff entry_point = 0x0 region_type = private name = "private_0x0000008256180000" filename = "" Region: id = 348 start_va = 0x7ffaf4e50000 end_va = 0x7ffaf502cfff entry_point = 0x7ffaf4e50000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 349 start_va = 0x7ffaf70d0000 end_va = 0x7ffaf717cfff entry_point = 0x7ffaf70d0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 350 start_va = 0x8255f80000 end_va = 0x8255f8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008255f80000" filename = "" Region: id = 351 start_va = 0x8256000000 end_va = 0x82560bdfff entry_point = 0x8256000000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 352 start_va = 0x82560c0000 end_va = 0x82560fffff entry_point = 0x0 region_type = private name = "private_0x00000082560c0000" filename = "" Region: id = 353 start_va = 0x7ff7fcce0000 end_va = 0x7ff7fcddffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7fcce0000" filename = "" Region: id = 354 start_va = 0x7ff7fce0c000 end_va = 0x7ff7fce0dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7fce0c000" filename = "" Region: id = 355 start_va = 0x7ffaf5700000 end_va = 0x7ffaf579cfff entry_point = 0x7ffaf5700000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 356 start_va = 0x8255f90000 end_va = 0x8255f96fff entry_point = 0x0 region_type = private name = "private_0x0000008255f90000" filename = "" Region: id = 357 start_va = 0x8256100000 end_va = 0x8256100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008256100000" filename = "" Region: id = 358 start_va = 0x8256110000 end_va = 0x8256116fff entry_point = 0x0 region_type = private name = "private_0x0000008256110000" filename = "" Region: id = 359 start_va = 0x8256370000 end_va = 0x825637ffff entry_point = 0x0 region_type = private name = "private_0x0000008256370000" filename = "" Region: id = 360 start_va = 0x7ffae05b0000 end_va = 0x7ffae0602fff entry_point = 0x7ffae05b0000 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 361 start_va = 0x7ffaf1040000 end_va = 0x7ffaf11c2fff entry_point = 0x7ffaf1040000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 362 start_va = 0x7ffaf5140000 end_va = 0x7ffaf528dfff entry_point = 0x7ffaf5140000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 363 start_va = 0x7ffaf5290000 end_va = 0x7ffaf53b5fff entry_point = 0x7ffaf5290000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 364 start_va = 0x7ffaf53c0000 end_va = 0x7ffaf53f5fff entry_point = 0x7ffaf53c0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 365 start_va = 0x7ffaf55b0000 end_va = 0x7ffaf56f0fff entry_point = 0x7ffaf55b0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 366 start_va = 0x7ffaf57a0000 end_va = 0x7ffaf57fafff entry_point = 0x7ffaf57a0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 367 start_va = 0x7ffaf5800000 end_va = 0x7ffaf5984fff entry_point = 0x7ffaf5800000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 368 start_va = 0x7ffaf6f70000 end_va = 0x7ffaf70cbfff entry_point = 0x7ffaf6f70000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 369 start_va = 0x7ffaf7190000 end_va = 0x7ffaf724dfff entry_point = 0x7ffaf7190000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 370 start_va = 0x7ffaf72e0000 end_va = 0x7ffaf755bfff entry_point = 0x7ffaf72e0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 393 start_va = 0x8256120000 end_va = 0x8256120fff entry_point = 0x0 region_type = private name = "private_0x0000008256120000" filename = "" Region: id = 394 start_va = 0x8256130000 end_va = 0x8256130fff entry_point = 0x0 region_type = private name = "private_0x0000008256130000" filename = "" Region: id = 395 start_va = 0x8256140000 end_va = 0x825617ffff entry_point = 0x0 region_type = private name = "private_0x0000008256140000" filename = "" Region: id = 396 start_va = 0x8256330000 end_va = 0x825633ffff entry_point = 0x0 region_type = private name = "private_0x0000008256330000" filename = "" Region: id = 397 start_va = 0x8256380000 end_va = 0x8256507fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008256380000" filename = "" Region: id = 398 start_va = 0x8256510000 end_va = 0x8256690fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000008256510000" filename = "" Region: id = 399 start_va = 0x82566a0000 end_va = 0x8257a9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000082566a0000" filename = "" Region: id = 400 start_va = 0x7ff7fce0a000 end_va = 0x7ff7fce0bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7fce0a000" filename = "" Region: id = 401 start_va = 0x7ffaf4440000 end_va = 0x7ffaf4489fff entry_point = 0x7ffaf4440000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 402 start_va = 0x7ffaf4490000 end_va = 0x7ffaf44a2fff entry_point = 0x7ffaf4490000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 403 start_va = 0x7ffaf44d0000 end_va = 0x7ffaf44defff entry_point = 0x7ffaf44d0000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 404 start_va = 0x7ffaf4590000 end_va = 0x7ffaf4bb7fff entry_point = 0x7ffaf4590000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 405 start_va = 0x7ffaf4bc0000 end_va = 0x7ffaf4c72fff entry_point = 0x7ffaf4bc0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 406 start_va = 0x7ffaf5990000 end_va = 0x7ffaf6eb4fff entry_point = 0x7ffaf5990000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 407 start_va = 0x7ffaf75d0000 end_va = 0x7ffaf7675fff entry_point = 0x7ffaf75d0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 408 start_va = 0x7ffaf7860000 end_va = 0x7ffaf78b0fff entry_point = 0x7ffaf7860000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 409 start_va = 0x7ffaf2d10000 end_va = 0x7ffaf2da5fff entry_point = 0x7ffaf2d10000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Thread: id = 11 os_tid = 0xd64 Thread: id = 13 os_tid = 0xec0 Thread: id = 15 os_tid = 0xb0 Process: id = "4" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x5f652000" os_pid = "0xb04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdf4" cmd_line = "takeown /f logonui.exe" cur_dir = "C:\\Windows\\System32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013c81" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 432 start_va = 0x210000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 433 start_va = 0x230000 end_va = 0x231fff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 434 start_va = 0x240000 end_va = 0x253fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 435 start_va = 0x260000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 436 start_va = 0x2a0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 437 start_va = 0x2e0000 end_va = 0x2e3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 438 start_va = 0x2f0000 end_va = 0x2f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 439 start_va = 0x300000 end_va = 0x301fff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 440 start_va = 0x3c0000 end_va = 0x3cffff entry_point = 0x3c0000 region_type = mapped_file name = "takeown.exe" filename = "\\Windows\\SysWOW64\\takeown.exe" (normalized: "c:\\windows\\syswow64\\takeown.exe") Region: id = 441 start_va = 0x3d0000 end_va = 0x43cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 442 start_va = 0x77990000 end_va = 0x77b08fff entry_point = 0x77990000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 443 start_va = 0x7f1c0000 end_va = 0x7f1e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f1c0000" filename = "" Region: id = 444 start_va = 0x7f1e4000 end_va = 0x7f1e4fff entry_point = 0x0 region_type = private name = "private_0x000000007f1e4000" filename = "" Region: id = 445 start_va = 0x7f1ec000 end_va = 0x7f1eefff entry_point = 0x0 region_type = private name = "private_0x000000007f1ec000" filename = "" Region: id = 446 start_va = 0x7f1ef000 end_va = 0x7f1effff entry_point = 0x0 region_type = private name = "private_0x000000007f1ef000" filename = "" Region: id = 447 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 448 start_va = 0x7fff0000 end_va = 0x7dfaf7a0ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 449 start_va = 0x7dfaf7a10000 end_va = 0x7ffaf7a0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfaf7a10000" filename = "" Region: id = 450 start_va = 0x7ffaf7a10000 end_va = 0x7ffaf7bd1fff entry_point = 0x7ffaf7a10000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 451 start_va = 0x7ffaf7bd2000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffaf7bd2000" filename = "" Region: id = 452 start_va = 0x44a0000 end_va = 0x44affff entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 453 start_va = 0x73040000 end_va = 0x7308efff entry_point = 0x73040000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 454 start_va = 0x73090000 end_va = 0x73102fff entry_point = 0x73090000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 455 start_va = 0x45d0000 end_va = 0x46cffff entry_point = 0x0 region_type = private name = "private_0x00000000045d0000" filename = "" Region: id = 456 start_va = 0x73030000 end_va = 0x73037fff entry_point = 0x73030000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 457 start_va = 0x210000 end_va = 0x21ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 458 start_va = 0x220000 end_va = 0x223fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 459 start_va = 0x230000 end_va = 0x234fff entry_point = 0x230000 region_type = mapped_file name = "takeown.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\takeown.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\takeown.exe.mui") Region: id = 460 start_va = 0x310000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 461 start_va = 0x350000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 462 start_va = 0x390000 end_va = 0x390fff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 463 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 464 start_va = 0x43d0000 end_va = 0x448dfff entry_point = 0x43d0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 465 start_va = 0x45a0000 end_va = 0x45affff entry_point = 0x0 region_type = private name = "private_0x00000000045a0000" filename = "" Region: id = 466 start_va = 0x46d0000 end_va = 0x4857fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000046d0000" filename = "" Region: id = 467 start_va = 0x4860000 end_va = 0x49e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004860000" filename = "" Region: id = 468 start_va = 0x49f0000 end_va = 0x5deffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000049f0000" filename = "" Region: id = 469 start_va = 0x74800000 end_va = 0x74807fff entry_point = 0x74800000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 470 start_va = 0x74a30000 end_va = 0x74a88fff entry_point = 0x74a30000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 471 start_va = 0x74a90000 end_va = 0x74a99fff entry_point = 0x74a90000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 472 start_va = 0x74aa0000 end_va = 0x74abdfff entry_point = 0x74aa0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 473 start_va = 0x74ad0000 end_va = 0x74c0ffff entry_point = 0x74ad0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 474 start_va = 0x74c10000 end_va = 0x74c53fff entry_point = 0x74c10000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 475 start_va = 0x74d30000 end_va = 0x74ea5fff entry_point = 0x74d30000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 476 start_va = 0x74f70000 end_va = 0x75129fff entry_point = 0x74f70000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 477 start_va = 0x75130000 end_va = 0x7521ffff entry_point = 0x75130000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 478 start_va = 0x75220000 end_va = 0x7524afff entry_point = 0x75220000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 479 start_va = 0x76da0000 end_va = 0x76ebffff entry_point = 0x76da0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 480 start_va = 0x770b0000 end_va = 0x770f2fff entry_point = 0x770b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 481 start_va = 0x772c0000 end_va = 0x7736bfff entry_point = 0x772c0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 482 start_va = 0x77370000 end_va = 0x774bcfff entry_point = 0x77370000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 483 start_va = 0x778d0000 end_va = 0x7798dfff entry_point = 0x778d0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 484 start_va = 0x7f0c0000 end_va = 0x7f1bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f0c0000" filename = "" Region: id = 485 start_va = 0x7f1e9000 end_va = 0x7f1ebfff entry_point = 0x0 region_type = private name = "private_0x000000007f1e9000" filename = "" Thread: id = 17 os_tid = 0x92c Thread: id = 18 os_tid = 0x388 Process: id = "5" image_name = "icacls.exe" filename = "c:\\windows\\syswow64\\icacls.exe" page_root = "0x49d6a000" os_pid = "0x554" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdf4" cmd_line = "icacls logonui.exe /granted CIiHmnxMn6Ps:F" cur_dir = "C:\\Windows\\System32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013c81" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 486 start_va = 0x100000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 487 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 488 start_va = 0x130000 end_va = 0x143fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 489 start_va = 0x150000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 490 start_va = 0x190000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 491 start_va = 0x1d0000 end_va = 0x1d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 492 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 493 start_va = 0x1f0000 end_va = 0x1f1fff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 494 start_va = 0x13d0000 end_va = 0x13d9fff entry_point = 0x13d0000 region_type = mapped_file name = "icacls.exe" filename = "\\Windows\\SysWOW64\\icacls.exe" (normalized: "c:\\windows\\syswow64\\icacls.exe") Region: id = 495 start_va = 0x13e0000 end_va = 0x53dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000013e0000" filename = "" Region: id = 496 start_va = 0x77990000 end_va = 0x77b08fff entry_point = 0x77990000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 497 start_va = 0x7e970000 end_va = 0x7e992fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e970000" filename = "" Region: id = 498 start_va = 0x7e993000 end_va = 0x7e993fff entry_point = 0x0 region_type = private name = "private_0x000000007e993000" filename = "" Region: id = 499 start_va = 0x7e99c000 end_va = 0x7e99efff entry_point = 0x0 region_type = private name = "private_0x000000007e99c000" filename = "" Region: id = 500 start_va = 0x7e99f000 end_va = 0x7e99ffff entry_point = 0x0 region_type = private name = "private_0x000000007e99f000" filename = "" Region: id = 501 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 502 start_va = 0x7fff0000 end_va = 0x7dfaf7a0ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 503 start_va = 0x7dfaf7a10000 end_va = 0x7ffaf7a0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfaf7a10000" filename = "" Region: id = 504 start_va = 0x7ffaf7a10000 end_va = 0x7ffaf7bd1fff entry_point = 0x7ffaf7a10000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 505 start_va = 0x7ffaf7bd2000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffaf7bd2000" filename = "" Region: id = 506 start_va = 0x280000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 507 start_va = 0x73040000 end_va = 0x7308efff entry_point = 0x73040000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 508 start_va = 0x73090000 end_va = 0x73102fff entry_point = 0x73090000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 509 start_va = 0x3c0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 510 start_va = 0x73030000 end_va = 0x73037fff entry_point = 0x73030000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 511 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 512 start_va = 0x110000 end_va = 0x113fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 513 start_va = 0x200000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 514 start_va = 0x240000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 515 start_va = 0x290000 end_va = 0x34dfff entry_point = 0x290000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 516 start_va = 0x380000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 517 start_va = 0x73120000 end_va = 0x73147fff entry_point = 0x73120000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 518 start_va = 0x74a30000 end_va = 0x74a88fff entry_point = 0x74a30000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 519 start_va = 0x74a90000 end_va = 0x74a99fff entry_point = 0x74a90000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 520 start_va = 0x74aa0000 end_va = 0x74abdfff entry_point = 0x74aa0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 521 start_va = 0x74c60000 end_va = 0x74cdafff entry_point = 0x74c60000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 522 start_va = 0x74d30000 end_va = 0x74ea5fff entry_point = 0x74d30000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 523 start_va = 0x75130000 end_va = 0x7521ffff entry_point = 0x75130000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 524 start_va = 0x770b0000 end_va = 0x770f2fff entry_point = 0x770b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 525 start_va = 0x772c0000 end_va = 0x7736bfff entry_point = 0x772c0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 526 start_va = 0x778d0000 end_va = 0x7798dfff entry_point = 0x778d0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 527 start_va = 0x7e870000 end_va = 0x7e96ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e870000" filename = "" Region: id = 528 start_va = 0x7e999000 end_va = 0x7e99bfff entry_point = 0x0 region_type = private name = "private_0x000000007e999000" filename = "" Thread: id = 19 os_tid = 0x2c4 Thread: id = 20 os_tid = 0xb34 Process: id = "6" image_name = "takeown.exe" filename = "c:\\windows\\syswow64\\takeown.exe" page_root = "0x28d6f000" os_pid = "0x8d8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdf4" cmd_line = "takeown /f \"C:\\Windows\\System32\\en-US\" /r /d y" cur_dir = "C:\\Windows\\System32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013c81" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 529 start_va = 0x3c0000 end_va = 0x3cffff entry_point = 0x3c0000 region_type = mapped_file name = "takeown.exe" filename = "\\Windows\\SysWOW64\\takeown.exe" (normalized: "c:\\windows\\syswow64\\takeown.exe") Region: id = 530 start_va = 0xfe0000 end_va = 0x4fdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fe0000" filename = "" Region: id = 531 start_va = 0x4fe0000 end_va = 0x4ffffff entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 532 start_va = 0x5000000 end_va = 0x5001fff entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 533 start_va = 0x5010000 end_va = 0x5023fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005010000" filename = "" Region: id = 534 start_va = 0x5030000 end_va = 0x506ffff entry_point = 0x0 region_type = private name = "private_0x0000000005030000" filename = "" Region: id = 535 start_va = 0x5070000 end_va = 0x50affff entry_point = 0x0 region_type = private name = "private_0x0000000005070000" filename = "" Region: id = 536 start_va = 0x50b0000 end_va = 0x50b3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000050b0000" filename = "" Region: id = 537 start_va = 0x50c0000 end_va = 0x50c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000050c0000" filename = "" Region: id = 538 start_va = 0x50d0000 end_va = 0x50d1fff entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 539 start_va = 0x77990000 end_va = 0x77b08fff entry_point = 0x77990000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 540 start_va = 0x7e690000 end_va = 0x7e6b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e690000" filename = "" Region: id = 541 start_va = 0x7e6ba000 end_va = 0x7e6bafff entry_point = 0x0 region_type = private name = "private_0x000000007e6ba000" filename = "" Region: id = 542 start_va = 0x7e6bc000 end_va = 0x7e6befff entry_point = 0x0 region_type = private name = "private_0x000000007e6bc000" filename = "" Region: id = 543 start_va = 0x7e6bf000 end_va = 0x7e6bffff entry_point = 0x0 region_type = private name = "private_0x000000007e6bf000" filename = "" Region: id = 544 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 545 start_va = 0x7fff0000 end_va = 0x7dfaf7a0ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 546 start_va = 0x7dfaf7a10000 end_va = 0x7ffaf7a0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfaf7a10000" filename = "" Region: id = 547 start_va = 0x7ffaf7a10000 end_va = 0x7ffaf7bd1fff entry_point = 0x7ffaf7a10000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 548 start_va = 0x7ffaf7bd2000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffaf7bd2000" filename = "" Region: id = 549 start_va = 0x50e0000 end_va = 0x50effff entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 550 start_va = 0x73040000 end_va = 0x7308efff entry_point = 0x73040000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 551 start_va = 0x73090000 end_va = 0x73102fff entry_point = 0x73090000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 552 start_va = 0x5270000 end_va = 0x536ffff entry_point = 0x0 region_type = private name = "private_0x0000000005270000" filename = "" Region: id = 553 start_va = 0x73030000 end_va = 0x73037fff entry_point = 0x73030000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 554 start_va = 0x4fe0000 end_va = 0x4feffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004fe0000" filename = "" Region: id = 555 start_va = 0x4ff0000 end_va = 0x4ff3fff entry_point = 0x0 region_type = private name = "private_0x0000000004ff0000" filename = "" Region: id = 556 start_va = 0x5000000 end_va = 0x5004fff entry_point = 0x5000000 region_type = mapped_file name = "takeown.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\takeown.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\takeown.exe.mui") Region: id = 557 start_va = 0x50f0000 end_va = 0x51adfff entry_point = 0x50f0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 558 start_va = 0x51b0000 end_va = 0x51effff entry_point = 0x0 region_type = private name = "private_0x00000000051b0000" filename = "" Region: id = 559 start_va = 0x51f0000 end_va = 0x522ffff entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 560 start_va = 0x5230000 end_va = 0x5230fff entry_point = 0x0 region_type = private name = "private_0x0000000005230000" filename = "" Region: id = 561 start_va = 0x5240000 end_va = 0x5240fff entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 562 start_va = 0x54d0000 end_va = 0x54dffff entry_point = 0x0 region_type = private name = "private_0x00000000054d0000" filename = "" Region: id = 563 start_va = 0x54e0000 end_va = 0x5667fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000054e0000" filename = "" Region: id = 564 start_va = 0x5670000 end_va = 0x57f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005670000" filename = "" Region: id = 565 start_va = 0x5800000 end_va = 0x6bfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005800000" filename = "" Region: id = 566 start_va = 0x6c00000 end_va = 0x6f36fff entry_point = 0x6c00000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 567 start_va = 0x73120000 end_va = 0x73147fff entry_point = 0x73120000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 568 start_va = 0x74800000 end_va = 0x74807fff entry_point = 0x74800000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 569 start_va = 0x74a30000 end_va = 0x74a88fff entry_point = 0x74a30000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 570 start_va = 0x74a90000 end_va = 0x74a99fff entry_point = 0x74a90000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 571 start_va = 0x74aa0000 end_va = 0x74abdfff entry_point = 0x74aa0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 572 start_va = 0x74ad0000 end_va = 0x74c0ffff entry_point = 0x74ad0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 573 start_va = 0x74c10000 end_va = 0x74c53fff entry_point = 0x74c10000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 574 start_va = 0x74c60000 end_va = 0x74cdafff entry_point = 0x74c60000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 575 start_va = 0x74d30000 end_va = 0x74ea5fff entry_point = 0x74d30000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 576 start_va = 0x74f70000 end_va = 0x75129fff entry_point = 0x74f70000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 577 start_va = 0x75130000 end_va = 0x7521ffff entry_point = 0x75130000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 578 start_va = 0x75220000 end_va = 0x7524afff entry_point = 0x75220000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 579 start_va = 0x76da0000 end_va = 0x76ebffff entry_point = 0x76da0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 580 start_va = 0x770b0000 end_va = 0x770f2fff entry_point = 0x770b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 581 start_va = 0x772c0000 end_va = 0x7736bfff entry_point = 0x772c0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 582 start_va = 0x77370000 end_va = 0x774bcfff entry_point = 0x77370000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 583 start_va = 0x778d0000 end_va = 0x7798dfff entry_point = 0x778d0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 584 start_va = 0x7e590000 end_va = 0x7e68ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e590000" filename = "" Region: id = 585 start_va = 0x7e6b7000 end_va = 0x7e6b9fff entry_point = 0x0 region_type = private name = "private_0x000000007e6b7000" filename = "" Thread: id = 21 os_tid = 0xc10 Thread: id = 22 os_tid = 0xc28 Process: id = "7" image_name = "icacls.exe" filename = "c:\\windows\\syswow64\\icacls.exe" page_root = "0x2ab74000" os_pid = "0x444" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdf4" cmd_line = "icacls \"C:\\Windows\\System32\\en-US\" /granted CIiHmnxMn6Ps:F /T /C" cur_dir = "C:\\Windows\\System32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013c81" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 586 start_va = 0xeb0000 end_va = 0xecffff entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 587 start_va = 0xed0000 end_va = 0xed1fff entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 588 start_va = 0xee0000 end_va = 0xef3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ee0000" filename = "" Region: id = 589 start_va = 0xf00000 end_va = 0xf3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 590 start_va = 0xf40000 end_va = 0xf7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 591 start_va = 0xf80000 end_va = 0xf83fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f80000" filename = "" Region: id = 592 start_va = 0xf90000 end_va = 0xf90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f90000" filename = "" Region: id = 593 start_va = 0xfa0000 end_va = 0xfa1fff entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 594 start_va = 0x13d0000 end_va = 0x13d9fff entry_point = 0x13d0000 region_type = mapped_file name = "icacls.exe" filename = "\\Windows\\SysWOW64\\icacls.exe" (normalized: "c:\\windows\\syswow64\\icacls.exe") Region: id = 595 start_va = 0x13e0000 end_va = 0x53dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000013e0000" filename = "" Region: id = 596 start_va = 0x77990000 end_va = 0x77b08fff entry_point = 0x77990000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 597 start_va = 0x7f260000 end_va = 0x7f282fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f260000" filename = "" Region: id = 598 start_va = 0x7f289000 end_va = 0x7f289fff entry_point = 0x0 region_type = private name = "private_0x000000007f289000" filename = "" Region: id = 599 start_va = 0x7f28c000 end_va = 0x7f28cfff entry_point = 0x0 region_type = private name = "private_0x000000007f28c000" filename = "" Region: id = 600 start_va = 0x7f28d000 end_va = 0x7f28ffff entry_point = 0x0 region_type = private name = "private_0x000000007f28d000" filename = "" Region: id = 601 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 602 start_va = 0x7fff0000 end_va = 0x7dfaf7a0ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 603 start_va = 0x7dfaf7a10000 end_va = 0x7ffaf7a0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfaf7a10000" filename = "" Region: id = 604 start_va = 0x7ffaf7a10000 end_va = 0x7ffaf7bd1fff entry_point = 0x7ffaf7a10000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 605 start_va = 0x7ffaf7bd2000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffaf7bd2000" filename = "" Region: id = 606 start_va = 0x1190000 end_va = 0x119ffff entry_point = 0x0 region_type = private name = "private_0x0000000001190000" filename = "" Region: id = 607 start_va = 0x73040000 end_va = 0x7308efff entry_point = 0x73040000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 608 start_va = 0x73090000 end_va = 0x73102fff entry_point = 0x73090000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 609 start_va = 0x12c0000 end_va = 0x13bffff entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 610 start_va = 0x73030000 end_va = 0x73037fff entry_point = 0x73030000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 611 start_va = 0xeb0000 end_va = 0xebffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000eb0000" filename = "" Region: id = 612 start_va = 0xec0000 end_va = 0xec3fff entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 613 start_va = 0xfb0000 end_va = 0x106dfff entry_point = 0xfb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 614 start_va = 0x1070000 end_va = 0x10affff entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 615 start_va = 0x10b0000 end_va = 0x10effff entry_point = 0x0 region_type = private name = "private_0x00000000010b0000" filename = "" Region: id = 616 start_va = 0x10f0000 end_va = 0x112ffff entry_point = 0x0 region_type = private name = "private_0x00000000010f0000" filename = "" Region: id = 617 start_va = 0x1130000 end_va = 0x116ffff entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 618 start_va = 0x5520000 end_va = 0x552ffff entry_point = 0x0 region_type = private name = "private_0x0000000005520000" filename = "" Region: id = 619 start_va = 0x74a00000 end_va = 0x74a27fff entry_point = 0x74a00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 620 start_va = 0x74a30000 end_va = 0x74a88fff entry_point = 0x74a30000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 621 start_va = 0x74a90000 end_va = 0x74a99fff entry_point = 0x74a90000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 622 start_va = 0x74aa0000 end_va = 0x74abdfff entry_point = 0x74aa0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 623 start_va = 0x74c60000 end_va = 0x74cdafff entry_point = 0x74c60000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 624 start_va = 0x74d30000 end_va = 0x74ea5fff entry_point = 0x74d30000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 625 start_va = 0x75130000 end_va = 0x7521ffff entry_point = 0x75130000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 626 start_va = 0x770b0000 end_va = 0x770f2fff entry_point = 0x770b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 627 start_va = 0x772c0000 end_va = 0x7736bfff entry_point = 0x772c0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 628 start_va = 0x778d0000 end_va = 0x7798dfff entry_point = 0x778d0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 629 start_va = 0x7f160000 end_va = 0x7f25ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f160000" filename = "" Region: id = 630 start_va = 0x7f283000 end_va = 0x7f285fff entry_point = 0x0 region_type = private name = "private_0x000000007f283000" filename = "" Region: id = 631 start_va = 0x7f286000 end_va = 0x7f288fff entry_point = 0x0 region_type = private name = "private_0x000000007f286000" filename = "" Thread: id = 26 os_tid = 0xd7c Thread: id = 27 os_tid = 0x548 Thread: id = 28 os_tid = 0x534