# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 09:10:47 # Log Creation Date: 10.10.2020 22:40:32.609 Process: id = "1" image_name = "qrej4lz7xrqqfsu3.exe" filename = "c:\\users\\fd1hvy\\desktop\\qrej4lz7xrqqfsu3.exe" page_root = "0x1bcbd000" os_pid = "0x11e0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7e0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x1234 [0052.700] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0053.115] RoInitialize () returned 0x1 [0053.116] RoUninitialize () returned 0x0 [0054.090] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fe6b0 | out: phkResult=0x8fe6b0*=0x0) returned 0x2 [0054.090] RegCloseKey (hKey=0x80000002) returned 0x0 [0054.095] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x8fe908, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0054.105] IsAppThemed () returned 0x1 [0054.108] CoTaskMemAlloc (cb=0xf0) returned 0xab8f90 [0054.108] CreateActCtxA (pActCtx=0x8fee58) returned 0xab9184 [0054.215] CoTaskMemFree (pv=0xab8f90) [0054.222] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc151 [0054.222] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc195 [0054.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe.config", nBufferLength=0x105, lpBuffer=0x8fe770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe.config", lpFilePart=0x0) returned 0x33 [0055.040] GetCurrentProcess () returned 0xffffffff [0055.040] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fead8 | out: TokenHandle=0x8fead8*=0x2c0) returned 1 [0055.042] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x8fe564, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0055.045] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x8fead0 | out: lpFileInformation=0x8fead0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0055.046] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x8fe530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0055.046] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x8fead8 | out: lpFileInformation=0x8fead8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0055.047] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x8fe4cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0055.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea10) returned 1 [0055.048] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0055.048] GetFileType (hFile=0xe4) returned 0x1 [0055.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea0c) returned 1 [0055.048] GetFileType (hFile=0xe4) returned 0x1 [0055.079] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea5c | out: phkResult=0x8fea5c*=0x0) returned 0x2 [0055.079] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea5c | out: phkResult=0x8fea5c*=0x0) returned 0x2 [0055.081] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8feacc | out: lpFileSizeHigh=0x8feacc*=0x0) returned 0x8c8f [0055.081] ReadFile (in: hFile=0xe4, lpBuffer=0x26cb22c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fea88, lpOverlapped=0x0 | out: lpBuffer=0x26cb22c*, lpNumberOfBytesRead=0x8fea88*=0x1000, lpOverlapped=0x0) returned 1 [0055.093] ReadFile (in: hFile=0xe4, lpBuffer=0x26cb22c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x26cb22c*, lpNumberOfBytesRead=0x8fe934*=0x1000, lpOverlapped=0x0) returned 1 [0055.095] ReadFile (in: hFile=0xe4, lpBuffer=0x26cb22c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e8, lpOverlapped=0x0 | out: lpBuffer=0x26cb22c*, lpNumberOfBytesRead=0x8fe7e8*=0x1000, lpOverlapped=0x0) returned 1 [0055.095] ReadFile (in: hFile=0xe4, lpBuffer=0x26cb22c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e8, lpOverlapped=0x0 | out: lpBuffer=0x26cb22c*, lpNumberOfBytesRead=0x8fe7e8*=0x1000, lpOverlapped=0x0) returned 1 [0055.096] ReadFile (in: hFile=0xe4, lpBuffer=0x26cb22c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e8, lpOverlapped=0x0 | out: lpBuffer=0x26cb22c*, lpNumberOfBytesRead=0x8fe7e8*=0x1000, lpOverlapped=0x0) returned 1 [0055.096] ReadFile (in: hFile=0xe4, lpBuffer=0x26cb22c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe720, lpOverlapped=0x0 | out: lpBuffer=0x26cb22c*, lpNumberOfBytesRead=0x8fe720*=0x1000, lpOverlapped=0x0) returned 1 [0055.100] ReadFile (in: hFile=0xe4, lpBuffer=0x26cb22c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe8a4, lpOverlapped=0x0 | out: lpBuffer=0x26cb22c*, lpNumberOfBytesRead=0x8fe8a4*=0x1000, lpOverlapped=0x0) returned 1 [0055.101] ReadFile (in: hFile=0xe4, lpBuffer=0x26cb22c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7b0, lpOverlapped=0x0 | out: lpBuffer=0x26cb22c*, lpNumberOfBytesRead=0x8fe7b0*=0x1000, lpOverlapped=0x0) returned 1 [0055.101] ReadFile (in: hFile=0xe4, lpBuffer=0x26cb22c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7b0, lpOverlapped=0x0 | out: lpBuffer=0x26cb22c*, lpNumberOfBytesRead=0x8fe7b0*=0xc8f, lpOverlapped=0x0) returned 1 [0055.102] ReadFile (in: hFile=0xe4, lpBuffer=0x26cb22c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe874, lpOverlapped=0x0 | out: lpBuffer=0x26cb22c*, lpNumberOfBytesRead=0x8fe874*=0x0, lpOverlapped=0x0) returned 1 [0055.102] CloseHandle (hObject=0xe4) returned 1 [0055.103] GetCurrentProcess () returned 0xffffffff [0055.103] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fec20 | out: TokenHandle=0x8fec20*=0xe4) returned 1 [0055.103] GetCurrentProcess () returned 0xffffffff [0055.103] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fec20 | out: TokenHandle=0x8fec20*=0x2c8) returned 1 [0055.103] GetCurrentProcess () returned 0xffffffff [0055.103] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fead8 | out: TokenHandle=0x8fead8*=0x2cc) returned 1 [0055.103] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\qrej4lz7xrqqfsu3.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x8fead0 | out: lpFileInformation=0x8fead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.104] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe.config", nBufferLength=0x105, lpBuffer=0x8fe530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe.config", lpFilePart=0x0) returned 0x33 [0055.104] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\qrej4lz7xrqqfsu3.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x8fead8 | out: lpFileInformation=0x8fead8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.104] GetCurrentProcess () returned 0xffffffff [0055.104] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fec20 | out: TokenHandle=0x8fec20*=0x2d0) returned 1 [0055.104] GetCurrentProcess () returned 0xffffffff [0055.104] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fec20 | out: TokenHandle=0x8fec20*=0x2d4) returned 1 [0055.115] GetCurrentProcess () returned 0xffffffff [0055.115] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fea80 | out: TokenHandle=0x8fea80*=0x2d8) returned 1 [0055.118] GetCurrentProcess () returned 0xffffffff [0055.118] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fea90 | out: TokenHandle=0x8fea90*=0x2dc) returned 1 [0055.127] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0055.131] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6f8f0000 [0055.559] AdjustWindowRectEx (in: lpRect=0x8feeb0, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x8feeb0) returned 1 [0055.563] GetCurrentProcess () returned 0xffffffff [0055.563] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x8fedc4, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x8fedc4*=0x2e4) returned 1 [0055.570] GetCurrentActCtx (in: lphActCtx=0x8fed24 | out: lphActCtx=0x8fed24*=0x0) returned 1 [0055.570] ActivateActCtx (in: hActCtx=0xab9184, lpCookie=0x8fed34 | out: hActCtx=0xab9184, lpCookie=0x8fed34) returned 1 [0055.570] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0055.573] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6f6e0000 [0056.239] GetModuleHandleW (lpModuleName="user32.dll") returned 0x77260000 [0056.239] GetProcAddress (hModule=0x77260000, lpProcName="DefWindowProcW") returned 0x73f70140 [0056.239] GetStockObject (i=5) returned 0x900015 [0056.241] GetModuleHandleW (lpModuleName=0x0) returned 0x4c0000 [0056.243] CoTaskMemAlloc (cb=0x5a) returned 0xac2d08 [0056.243] RegisterClassW (lpWndClass=0x8febd8) returned 0xc197 [0056.243] CoTaskMemFree (pv=0xac2d08) [0056.243] GetModuleHandleW (lpModuleName=0x0) returned 0x4c0000 [0056.244] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x4c0000, lpParam=0x0) returned 0x201cc [0056.244] SetWindowLongW (hWnd=0x201cc, nIndex=-4, dwNewLong=1945567552) returned 80545254 [0056.245] GetWindowLongW (hWnd=0x201cc, nIndex=-4) returned 1945567552 [0056.245] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fe3f8 | out: phkResult=0x8fe3f8*=0x2fc) returned 0x0 [0056.246] RegQueryValueExW (in: hKey=0x2fc, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x8fe418, lpData=0x0, lpcbData=0x8fe414*=0x0 | out: lpType=0x8fe418*=0x0, lpData=0x0, lpcbData=0x8fe414*=0x0) returned 0x2 [0056.246] RegQueryValueExW (in: hKey=0x2fc, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x8fe418, lpData=0x0, lpcbData=0x8fe414*=0x0 | out: lpType=0x8fe418*=0x0, lpData=0x0, lpcbData=0x8fe414*=0x0) returned 0x2 [0056.246] RegCloseKey (hKey=0x2fc) returned 0x0 [0056.246] SetWindowLongW (hWnd=0x201cc, nIndex=-4, dwNewLong=80545294) returned 1945567552 [0056.247] GetWindowLongW (hWnd=0x201cc, nIndex=-4) returned 80545294 [0056.247] GetWindowLongW (hWnd=0x201cc, nIndex=-16) returned 113311744 [0056.247] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc198 [0056.248] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc199 [0056.248] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x201cc, Msg=0x81, wParam=0x0, lParam=0x8fe748) returned 0x1 [0056.248] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x201cc, Msg=0x83, wParam=0x0, lParam=0x8fe734) returned 0x0 [0056.439] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x201cc, Msg=0x1, wParam=0x0, lParam=0x8fe748) returned 0x0 [0056.439] GetClientRect (in: hWnd=0x201cc, lpRect=0x8fe430 | out: lpRect=0x8fe430) returned 1 [0056.439] GetWindowRect (in: hWnd=0x201cc, lpRect=0x8fe430 | out: lpRect=0x8fe430) returned 1 [0056.440] GetParent (hWnd=0x201cc) returned 0x0 [0056.440] DeactivateActCtx (dwFlags=0x0, ulCookie=0x165a0001) returned 1 [0056.479] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f8f0000 [0056.479] AdjustWindowRectEx (in: lpRect=0x8fee9c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fee9c) returned 1 [0056.479] GetSystemMetrics (nIndex=59) returned 1460 [0056.479] GetSystemMetrics (nIndex=60) returned 920 [0056.479] GetSystemMetrics (nIndex=34) returned 136 [0056.479] GetSystemMetrics (nIndex=35) returned 39 [0056.479] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f8f0000 [0056.479] AdjustWindowRectEx (in: lpRect=0x8fed9c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fed9c) returned 1 [0056.481] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f8f0000 [0056.481] AdjustWindowRectEx (in: lpRect=0x8feda4, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8feda4) returned 1 [0056.481] AdjustWindowRectEx (in: lpRect=0x8fee70, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fee70) returned 1 [0056.481] GetSystemMetrics (nIndex=59) returned 1460 [0056.481] GetSystemMetrics (nIndex=60) returned 920 [0056.481] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f8f0000 [0056.481] AdjustWindowRectEx (in: lpRect=0x8feca8, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8feca8) returned 1 [0056.481] AdjustWindowRectEx (in: lpRect=0x8fed70, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fed70) returned 1 [0056.482] CreateCompatibleDC (hdc=0x0) returned 0x23010543 [0056.488] GetSystemDefaultLCID () returned 0x409 [0056.488] GetStockObject (i=17) returned 0xa01c1 [0056.489] GetObjectW (in: h=0xa01c1, c=92, pv=0x8febe0 | out: pv=0x8febe0) returned 92 [0056.489] GetDC (hWnd=0x0) returned 0x2a010540 [0056.572] GdiplusStartup (in: token=0xa45ed8, input=0x8fe198, output=0x8fe1e8 | out: token=0xa45ed8, output=0x8fe1e8) returned 0x0 [0056.578] CoTaskMemAlloc (cb=0x5c) returned 0xac2688 [0056.580] GdipCreateFontFromLogfontW (hdc=0x2a010540, logfont=0xac2688, font=0x8feca8) returned 0x0 [0056.877] CoTaskMemFree (pv=0xac2688) [0056.878] CoTaskMemAlloc (cb=0x5c) returned 0xac2d08 [0056.878] CoTaskMemFree (pv=0xac2d08) [0056.878] CoTaskMemAlloc (cb=0x5c) returned 0xac2d08 [0056.878] CoTaskMemFree (pv=0xac2d08) [0056.878] GdipGetFontUnit (font=0x4c31f08, unit=0x8fec70) returned 0x0 [0056.878] GdipGetFontSize (font=0x4c31f08, size=0x8fec74) returned 0x0 [0056.878] GdipGetFontStyle (font=0x4c31f08, style=0x8fec6c) returned 0x0 [0056.878] GdipGetFamily (font=0x4c31f08, family=0x8fec68) returned 0x0 [0056.879] GdipGetFontSize (font=0x4c31f08, size=0x26e7594) returned 0x0 [0056.879] ReleaseDC (hWnd=0x0, hDC=0x2a010540) returned 1 [0056.879] GetDC (hWnd=0x0) returned 0x10105d6 [0056.879] GdipCreateFromHDC (hdc=0x10105d6, graphics=0x8fec84) returned 0x0 [0056.884] GdipGetDpiY (graphics=0x602f260, dpi=0x26e7670) returned 0x0 [0056.884] GdipGetFontHeight (font=0x4c31f08, graphics=0x602f260, height=0x8fec7c) returned 0x0 [0056.884] GdipGetEmHeight (family=0x4c39038, style=0, EmHeight=0x8fec84) returned 0x0 [0056.885] GdipGetLineSpacing (family=0x4c39038, style=0, LineSpacing=0x8fec84) returned 0x0 [0056.885] GdipDeleteGraphics (graphics=0x602f260) returned 0x0 [0056.885] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0056.885] GdipCreateFont (fontFamily=0x4c39038, emSize=0x41040000, style=0, unit=0x3, font=0x26e768c) returned 0x0 [0056.885] GdipGetFontSize (font=0x4c3ef48, size=0x26e7690) returned 0x0 [0056.885] GdipDeleteFont (font=0x4c31f08) returned 0x0 [0056.885] GetDC (hWnd=0x0) returned 0x10105d6 [0056.885] GdipCreateFromHDC (hdc=0x10105d6, graphics=0x8fecb8) returned 0x0 [0056.886] CoTaskMemAlloc (cb=0x5c) returned 0xac27c0 [0056.888] GdipGetLogFontW (font=0x4c3ef48, graphics=0x602f260, logfontW=0xac27c0) returned 0x0 [0056.894] CoTaskMemFree (pv=0xac27c0) [0056.894] CoTaskMemAlloc (cb=0x5c) returned 0xac2620 [0056.894] CoTaskMemFree (pv=0xac2620) [0056.894] CoTaskMemAlloc (cb=0x5c) returned 0xac2c38 [0056.894] CoTaskMemFree (pv=0xac2c38) [0056.894] GdipDeleteGraphics (graphics=0x602f260) returned 0x0 [0056.894] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0056.895] CoTaskMemAlloc (cb=0x5c) returned 0xac2b00 [0056.895] CreateFontIndirectW (lplf=0xac2b00) returned 0x2c0a04fe [0056.895] CoTaskMemFree (pv=0xac2b00) [0056.895] SelectObject (hdc=0x23010543, h=0x2c0a04fe) returned 0x8a01c2 [0056.895] GetTextMetricsW (in: hdc=0x23010543, lptm=0x8fedc4 | out: lptm=0x8fedc4) returned 1 [0056.896] GetTextExtentPoint32W (in: hdc=0x23010543, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x26e78b8 | out: psizl=0x26e78b8) returned 1 [0056.897] SelectObject (hdc=0x23010543, h=0x8a01c2) returned 0x2c0a04fe [0056.899] DeleteDC (hdc=0x23010543) returned 1 [0056.899] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f8f0000 [0056.899] AdjustWindowRectEx (in: lpRect=0x8feb2c, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8feb2c) returned 1 [0056.899] AdjustWindowRectEx (in: lpRect=0x8fed50, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fed50) returned 1 [0056.900] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f8f0000 [0056.900] AdjustWindowRectEx (in: lpRect=0x8feaa4, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8feaa4) returned 1 [0056.900] AdjustWindowRectEx (in: lpRect=0x8feb88, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8feb88) returned 1 [0056.902] GetSystemMetrics (nIndex=59) returned 1460 [0056.902] GetSystemMetrics (nIndex=60) returned 920 [0056.902] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f8f0000 [0056.902] AdjustWindowRectEx (in: lpRect=0x8fea34, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fea34) returned 1 [0056.902] AdjustWindowRectEx (in: lpRect=0x8feafc, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8feafc) returned 1 [0056.902] GetCurrentActCtx (in: lphActCtx=0x8feecc | out: lphActCtx=0x8feecc*=0x0) returned 1 [0056.902] ActivateActCtx (in: hActCtx=0xab9184, lpCookie=0x8feedc | out: hActCtx=0xab9184, lpCookie=0x8feedc) returned 1 [0056.902] GetCurrentActCtx (in: lphActCtx=0x8fecec | out: lphActCtx=0x8fecec*=0xab9184) returned 1 [0056.902] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f6e0000 [0056.903] AdjustWindowRectEx (in: lpRect=0x8fec4c, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fec4c) returned 1 [0056.903] GetModuleHandleW (lpModuleName=0x0) returned 0x4c0000 [0056.903] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=-2147483648, Y=-2147483648, nWidth=8, nHeight=8, hWndParent=0x0, hMenu=0x0, hInstance=0x4c0000, lpParam=0x0) returned 0x50204 [0056.903] SetWindowLongW (hWnd=0x50204, nIndex=-4, dwNewLong=1945567552) returned 80545254 [0056.903] GetWindowLongW (hWnd=0x50204, nIndex=-4) returned 1945567552 [0056.903] SetWindowLongW (hWnd=0x50204, nIndex=-4, dwNewLong=80545334) returned 1945567552 [0056.903] GetWindowLongW (hWnd=0x50204, nIndex=-4) returned 80545334 [0056.903] GetWindowLongW (hWnd=0x50204, nIndex=-16) returned 113311744 [0056.904] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x81, wParam=0x0, lParam=0x8fe710) returned 0x1 [0056.906] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x83, wParam=0x0, lParam=0x8fe6fc) returned 0x0 [0056.907] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x1, wParam=0x0, lParam=0x8fe710) returned 0x0 [0056.907] GetClientRect (in: hWnd=0x50204, lpRect=0x8fe3c8 | out: lpRect=0x8fe3c8) returned 1 [0056.907] GetWindowRect (in: hWnd=0x50204, lpRect=0x8fe3c8 | out: lpRect=0x8fe3c8) returned 1 [0056.907] GetWindowTextLengthW (hWnd=0x50204) returned 0 [0056.907] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0056.907] GetSystemMetrics (nIndex=42) returned 0 [0056.907] GetWindowTextW (in: hWnd=0x50204, lpString=0x8fe240, nMaxCount=1 | out: lpString="") returned 0 [0056.907] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0xd, wParam=0x1, lParam=0x8fe240) returned 0x0 [0056.914] GetUserObjectInformationA (in: hObj=0x13c, nIndex=1, pvInfo=0x26e7ed4, nLength=0xc, lpnLengthNeeded=0x8fe2c0 | out: pvInfo=0x26e7ed4, lpnLengthNeeded=0x8fe2c0) returned 1 [0056.917] SetConsoleCtrlHandler (HandlerRoutine=0x4cd065e, Add=1) returned 1 [0056.918] GetModuleHandleW (lpModuleName=0x0) returned 0x4c0000 [0056.918] GetModuleHandleW (lpModuleName=0x0) returned 0x4c0000 [0056.919] GetClassInfoW (in: hInstance=0x4c0000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x26e7f38 | out: lpWndClass=0x26e7f38) returned 0 [0056.920] CoTaskMemAlloc (cb=0x58) returned 0xabf1e0 [0056.920] RegisterClassW (lpWndClass=0x8fe210) returned 0xc19b [0056.920] CoTaskMemFree (pv=0xabf1e0) [0056.921] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x4c0000, lpParam=0x0) returned 0x70044 [0056.922] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x83, wParam=0x0, lParam=0x8fdd3c) returned 0x0 [0056.922] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x1, wParam=0x0, lParam=0x8fdd50) returned 0x0 [0056.922] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0056.922] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0056.926] GetStartupInfoW (in: lpStartupInfo=0x26e83a4 | out: lpStartupInfo=0x26e83a4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0056.928] GetParent (hWnd=0x50204) returned 0x0 [0056.928] SetWindowLongW (hWnd=0x50204, nIndex=-8, dwNewLong=0) returned 0 [0056.931] GetSystemMetrics (nIndex=11) returned 32 [0056.931] GetSystemMetrics (nIndex=12) returned 32 [0056.931] GetDC (hWnd=0x0) returned 0x10105d6 [0056.931] GetDeviceCaps (hdc=0x10105d6, index=12) returned 32 [0056.931] GetDeviceCaps (hdc=0x10105d6, index=14) returned 1 [0056.931] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0056.931] CreateIconFromResourceEx (presbits=0x26eae04, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x50295 [0056.932] GetSystemMetrics (nIndex=49) returned 16 [0056.932] GetSystemMetrics (nIndex=50) returned 16 [0056.932] CreateIconFromResourceEx (presbits=0x26ebee8, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x902a1 [0056.933] SendMessageW (hWnd=0x50204, Msg=0x80, wParam=0x0, lParam=0x902a1) returned 0x0 [0056.933] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x80, wParam=0x0, lParam=0x902a1) returned 0x0 [0056.934] SendMessageW (hWnd=0x50204, Msg=0x80, wParam=0x1, lParam=0x50295) returned 0x0 [0056.934] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x80, wParam=0x1, lParam=0x50295) returned 0x0 [0056.934] GetSystemMenu (hWnd=0x50204, bRevert=0) returned 0x0 [0056.934] GetWindowPlacement (in: hWnd=0x50204, lpwndpl=0x8fecfc | out: lpwndpl=0x8fecfc) returned 1 [0056.934] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0056.934] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0056.934] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0056.934] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0056.934] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0056.935] GetClientRect (in: hWnd=0x50204, lpRect=0x8fed40 | out: lpRect=0x8fed40) returned 1 [0056.935] GetClientRect (in: hWnd=0x50204, lpRect=0x8feca0 | out: lpRect=0x8feca0) returned 1 [0056.935] GetWindowRect (in: hWnd=0x50204, lpRect=0x8feca0 | out: lpRect=0x8feca0) returned 1 [0056.935] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f6e0000 [0056.935] GetWindowLongW (hWnd=0x50204, nIndex=-16) returned 113311744 [0056.935] GetWindowLongW (hWnd=0x50204, nIndex=-16) returned 113311744 [0056.935] GetWindowLongW (hWnd=0x50204, nIndex=-20) returned 327936 [0056.935] SetWindowLongW (hWnd=0x50204, nIndex=-16, dwNewLong=33619968) returned 113311744 [0056.935] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x7c, wParam=0xfffffff0, lParam=0x8fec9c) returned 0x0 [0056.935] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x7d, wParam=0xfffffff0, lParam=0x8fec9c) returned 0x0 [0056.936] SetWindowLongW (hWnd=0x50204, nIndex=-20, dwNewLong=327680) returned 327680 [0056.936] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x7c, wParam=0xffffffec, lParam=0x8fec9c) returned 0x0 [0056.936] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x7d, wParam=0xffffffec, lParam=0x8fec9c) returned 0x0 [0056.937] SetWindowPos (hWnd=0x50204, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0056.937] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x46, wParam=0x0, lParam=0x8fecb4) returned 0x0 [0056.937] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x83, wParam=0x1, lParam=0x8fec8c) returned 0x0 [0056.938] GetWindowPlacement (in: hWnd=0x50204, lpwndpl=0x8fe9e0 | out: lpwndpl=0x8fe9e0) returned 1 [0056.938] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x47, wParam=0x0, lParam=0x8fecb4) returned 0x0 [0056.938] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x3, wParam=0x0, lParam=0x1a001a) returned 0x0 [0056.938] GetClientRect (in: hWnd=0x50204, lpRect=0x8fe2e0 | out: lpRect=0x8fe2e0) returned 1 [0056.938] GetWindowRect (in: hWnd=0x50204, lpRect=0x8fe2e0 | out: lpRect=0x8fe2e0) returned 1 [0056.938] GetWindowTextLengthW (hWnd=0x50204) returned 0 [0056.938] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0056.938] GetSystemMetrics (nIndex=42) returned 0 [0056.938] GetWindowTextW (in: hWnd=0x50204, lpString=0x8fe158, nMaxCount=1 | out: lpString="") returned 0 [0056.938] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0xd, wParam=0x1, lParam=0x8fe158) returned 0x0 [0056.938] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x5, wParam=0x0, lParam=0x270088) returned 0x0 [0056.938] GetClientRect (in: hWnd=0x50204, lpRect=0x8fe990 | out: lpRect=0x8fe990) returned 1 [0056.938] GetWindowRect (in: hWnd=0x50204, lpRect=0x8fe990 | out: lpRect=0x8fe990) returned 1 [0056.938] RedrawWindow (hWnd=0x50204, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0056.938] GetSystemMenu (hWnd=0x50204, bRevert=0) returned 0x0 [0056.938] GetWindowPlacement (in: hWnd=0x50204, lpwndpl=0x8fecec | out: lpwndpl=0x8fecec) returned 1 [0056.938] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0056.938] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0056.938] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0056.938] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0056.939] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0056.939] ShowWindow (hWnd=0x50204, nCmdShow=5) returned 0 [0056.939] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0056.939] GetWindowTextLengthW (hWnd=0x50204) returned 0 [0056.939] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0056.939] GetSystemMetrics (nIndex=42) returned 0 [0056.939] GetWindowTextW (in: hWnd=0x50204, lpString=0x8fe8f0, nMaxCount=1 | out: lpString="") returned 0 [0056.939] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0xd, wParam=0x1, lParam=0x8fe8f0) returned 0x0 [0056.963] ShowWindow (hWnd=0x50204, nCmdShow=0) returned 0 [0056.968] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f6e0000 [0056.968] GetWindowLongW (hWnd=0x50204, nIndex=-16) returned 100728832 [0056.968] GetWindowLongW (hWnd=0x50204, nIndex=-16) returned 100728832 [0056.968] GetWindowLongW (hWnd=0x50204, nIndex=-20) returned 327680 [0056.968] SetWindowLongW (hWnd=0x50204, nIndex=-16, dwNewLong=33619968) returned 100728832 [0056.968] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x7c, wParam=0xfffffff0, lParam=0x8fe844) returned 0x0 [0056.968] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x7d, wParam=0xfffffff0, lParam=0x8fe844) returned 0x0 [0056.968] SetWindowLongW (hWnd=0x50204, nIndex=-20, dwNewLong=851968) returned 327680 [0056.968] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x7c, wParam=0xffffffec, lParam=0x8fe844) returned 0x0 [0056.969] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x7d, wParam=0xffffffec, lParam=0x8fe844) returned 0x0 [0056.969] SetWindowPos (hWnd=0x50204, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0056.969] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x46, wParam=0x0, lParam=0x8fe85c) returned 0x0 [0056.969] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x83, wParam=0x1, lParam=0x8fe834) returned 0x0 [0056.970] GetWindowPlacement (in: hWnd=0x50204, lpwndpl=0x8fe588 | out: lpwndpl=0x8fe588) returned 1 [0056.970] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x47, wParam=0x0, lParam=0x8fe85c) returned 0x0 [0056.970] GetClientRect (in: hWnd=0x50204, lpRect=0x8fe538 | out: lpRect=0x8fe538) returned 1 [0056.970] GetWindowRect (in: hWnd=0x50204, lpRect=0x8fe538 | out: lpRect=0x8fe538) returned 1 [0056.970] RedrawWindow (hWnd=0x50204, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0056.970] GetSystemMenu (hWnd=0x50204, bRevert=0) returned 0x0 [0056.970] GetWindowPlacement (in: hWnd=0x50204, lpwndpl=0x8fe890 | out: lpwndpl=0x8fe890) returned 1 [0056.970] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0056.970] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0056.970] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0056.970] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0056.970] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0056.977] SetLayeredWindowAttributes (hwnd=0x50204, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0056.980] GetCurrentThreadId () returned 0x1234 [0056.990] EnumThreadWindows (dwThreadId=0x1234, lpfn=0x4cd06ae, lParam=0x50204) returned 1 [0057.008] GetWindowLongW (hWnd=0x70044, nIndex=-8) returned 0 [0057.008] GetWindowLongW (hWnd=0x50204, nIndex=-8) returned 0 [0057.008] GetWindowLongW (hWnd=0x70048, nIndex=-8) returned 328196 [0057.032] SetWindowLongW (hWnd=0x70048, nIndex=-8, dwNewLong=0) returned 328196 [0057.035] GetFocus () returned 0x0 [0057.035] GetParent (hWnd=0x50204) returned 0x0 [0057.035] GetWindowLongW (hWnd=0x50204, nIndex=-20) returned 851968 [0057.035] DestroyWindow (hWnd=0x50204) returned 1 [0057.035] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0057.038] GetWindowTextLengthW (hWnd=0x50204) returned 0 [0057.038] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0057.038] GetSystemMetrics (nIndex=42) returned 0 [0057.038] GetWindowTextW (in: hWnd=0x50204, lpString=0x8fe3a0, nMaxCount=1 | out: lpString="") returned 0 [0057.038] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0xd, wParam=0x1, lParam=0x8fe3a0) returned 0x0 [0057.038] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0057.039] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x50204, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0057.040] GetCurrentActCtx (in: lphActCtx=0x8fe7f0 | out: lphActCtx=0x8fe7f0*=0xab9184) returned 1 [0057.041] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f6e0000 [0057.041] GetModuleHandleW (lpModuleName=0x0) returned 0x4c0000 [0057.041] CreateWindowExW (dwExStyle=0x90000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=26, Y=26, nWidth=136, nHeight=39, hWndParent=0x0, hMenu=0x0, hInstance=0x4c0000, lpParam=0x0) returned 0x6014c [0057.041] SetWindowLongW (hWnd=0x6014c, nIndex=-4, dwNewLong=1945567552) returned 80545254 [0057.041] GetWindowLongW (hWnd=0x6014c, nIndex=-4) returned 1945567552 [0057.041] SetWindowLongW (hWnd=0x6014c, nIndex=-4, dwNewLong=80545494) returned 1945567552 [0057.042] GetWindowLongW (hWnd=0x6014c, nIndex=-4) returned 80545494 [0057.042] GetWindowLongW (hWnd=0x6014c, nIndex=-16) returned 113311744 [0057.042] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x81, wParam=0x0, lParam=0x8fe210) returned 0x1 [0057.042] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x83, wParam=0x0, lParam=0x8fe1fc) returned 0x0 [0057.043] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x1, wParam=0x0, lParam=0x8fe210) returned 0x0 [0057.043] GetClientRect (in: hWnd=0x6014c, lpRect=0x8fdec8 | out: lpRect=0x8fdec8) returned 1 [0057.043] GetWindowRect (in: hWnd=0x6014c, lpRect=0x8fdec8 | out: lpRect=0x8fdec8) returned 1 [0057.043] GetWindowTextLengthW (hWnd=0x6014c) returned 0 [0057.043] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0057.043] GetSystemMetrics (nIndex=42) returned 0 [0057.043] GetWindowTextW (in: hWnd=0x6014c, lpString=0x8fdd40, nMaxCount=1 | out: lpString="") returned 0 [0057.043] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0xd, wParam=0x1, lParam=0x8fdd40) returned 0x0 [0057.043] SetLayeredWindowAttributes (hwnd=0x6014c, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0057.044] GetStartupInfoW (in: lpStartupInfo=0x26eca44 | out: lpStartupInfo=0x26eca44*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0057.045] GetParent (hWnd=0x6014c) returned 0x0 [0057.045] GetStockObject (i=5) returned 0x900015 [0057.046] GetModuleHandleW (lpModuleName=0x0) returned 0x4c0000 [0057.046] CoTaskMemAlloc (cb=0x5a) returned 0xac2890 [0057.046] RegisterClassW (lpWndClass=0x8fe6cc) returned 0xc19c [0057.046] CoTaskMemFree (pv=0xac2890) [0057.046] GetModuleHandleW (lpModuleName=0x0) returned 0x4c0000 [0057.046] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x4c0000, lpParam=0x0) returned 0x6006a [0057.047] SetWindowLongW (hWnd=0x6006a, nIndex=-4, dwNewLong=1945567552) returned 80545534 [0057.047] GetWindowLongW (hWnd=0x6006a, nIndex=-4) returned 1945567552 [0057.047] SetWindowLongW (hWnd=0x6006a, nIndex=-4, dwNewLong=80545574) returned 1945567552 [0057.047] GetWindowLongW (hWnd=0x6006a, nIndex=-4) returned 80545574 [0057.047] GetWindowLongW (hWnd=0x6006a, nIndex=-16) returned 79691776 [0057.048] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6006a, Msg=0x24, wParam=0x0, lParam=0x8fe244) returned 0x0 [0057.048] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6006a, Msg=0x81, wParam=0x0, lParam=0x8fe238) returned 0x1 [0057.048] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6006a, Msg=0x83, wParam=0x0, lParam=0x8fe224) returned 0x0 [0057.049] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6006a, Msg=0x1, wParam=0x0, lParam=0x8fe238) returned 0x0 [0057.049] SetWindowLongW (hWnd=0x6014c, nIndex=-8, dwNewLong=393322) returned 0 [0057.050] SendMessageW (hWnd=0x6014c, Msg=0x80, wParam=0x0, lParam=0x902a1) returned 0x0 [0057.050] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x80, wParam=0x0, lParam=0x902a1) returned 0x0 [0057.051] SendMessageW (hWnd=0x6014c, Msg=0x80, wParam=0x1, lParam=0x50295) returned 0x0 [0057.051] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x80, wParam=0x1, lParam=0x50295) returned 0x0 [0057.054] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0xd, wParam=0x104, lParam=0x4d362c0) returned 0x0 [0057.055] GetSystemMenu (hWnd=0x6014c, bRevert=0) returned 0x0 [0057.055] GetWindowPlacement (in: hWnd=0x6014c, lpwndpl=0x8fe800 | out: lpwndpl=0x8fe800) returned 1 [0057.055] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0057.055] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0057.055] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0057.055] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0057.055] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0057.055] GetClientRect (in: hWnd=0x6014c, lpRect=0x8fe844 | out: lpRect=0x8fe844) returned 1 [0057.055] GetClientRect (in: hWnd=0x6014c, lpRect=0x8fe7a4 | out: lpRect=0x8fe7a4) returned 1 [0057.055] GetWindowRect (in: hWnd=0x6014c, lpRect=0x8fe7a4 | out: lpRect=0x8fe7a4) returned 1 [0057.055] SetWindowLongW (hWnd=0x6014c, nIndex=-8, dwNewLong=393322) returned 393322 [0057.056] SendMessageW (hWnd=0x6006a, Msg=0x80, wParam=0x1, lParam=0x50295) returned 0x0 [0057.056] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6006a, Msg=0x80, wParam=0x1, lParam=0x50295) returned 0x0 [0057.057] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6f6e0000 [0057.058] GetWindowLongW (hWnd=0x6014c, nIndex=-16) returned 113311744 [0057.058] GetWindowLongW (hWnd=0x6014c, nIndex=-16) returned 113311744 [0057.058] GetWindowLongW (hWnd=0x6014c, nIndex=-20) returned 590080 [0057.058] SetWindowLongW (hWnd=0x6014c, nIndex=-16, dwNewLong=33619968) returned 113311744 [0057.058] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x7c, wParam=0xfffffff0, lParam=0x8fe7a4) returned 0x0 [0057.058] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x7d, wParam=0xfffffff0, lParam=0x8fe7a4) returned 0x0 [0057.058] SetWindowLongW (hWnd=0x6014c, nIndex=-20, dwNewLong=589824) returned 589824 [0057.058] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x7c, wParam=0xffffffec, lParam=0x8fe7a4) returned 0x0 [0057.058] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x7d, wParam=0xffffffec, lParam=0x8fe7a4) returned 0x0 [0057.059] SetWindowPos (hWnd=0x6014c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0057.059] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x46, wParam=0x0, lParam=0x8fe7bc) returned 0x0 [0057.059] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x83, wParam=0x1, lParam=0x8fe794) returned 0x0 [0057.061] GetWindowPlacement (in: hWnd=0x6014c, lpwndpl=0x8fe4e8 | out: lpwndpl=0x8fe4e8) returned 1 [0057.061] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x47, wParam=0x0, lParam=0x8fe7bc) returned 0x0 [0057.061] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x3, wParam=0x0, lParam=0x1a001a) returned 0x0 [0057.061] GetClientRect (in: hWnd=0x6014c, lpRect=0x8fdde8 | out: lpRect=0x8fdde8) returned 1 [0057.061] GetWindowRect (in: hWnd=0x6014c, lpRect=0x8fdde8 | out: lpRect=0x8fdde8) returned 1 [0057.061] GetWindowTextLengthW (hWnd=0x6014c) returned 0 [0057.061] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0057.061] GetSystemMetrics (nIndex=42) returned 0 [0057.062] GetWindowTextW (in: hWnd=0x6014c, lpString=0x8fdc60, nMaxCount=1 | out: lpString="") returned 0 [0057.062] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0xd, wParam=0x1, lParam=0x8fdc60) returned 0x0 [0057.062] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x5, wParam=0x0, lParam=0x270088) returned 0x0 [0057.062] GetClientRect (in: hWnd=0x6014c, lpRect=0x8fe498 | out: lpRect=0x8fe498) returned 1 [0057.062] GetWindowRect (in: hWnd=0x6014c, lpRect=0x8fe498 | out: lpRect=0x8fe498) returned 1 [0057.062] RedrawWindow (hWnd=0x6014c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0057.062] GetSystemMenu (hWnd=0x6014c, bRevert=0) returned 0x0 [0057.062] GetWindowPlacement (in: hWnd=0x6014c, lpwndpl=0x8fe7f0 | out: lpwndpl=0x8fe7f0) returned 1 [0057.062] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0057.062] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0057.062] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0057.062] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0057.062] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0057.062] SetWindowLongW (hWnd=0x70048, nIndex=-8, dwNewLong=393548) returned 458820 [0057.065] GetCurrentProcess () returned 0xffffffff [0057.065] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe90c | out: TokenHandle=0x8fe90c*=0x334) returned 1 [0057.069] GetTokenInformation (in: TokenHandle=0x334, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x8fe910 | out: TokenInformation=0x0, ReturnLength=0x8fe910) returned 0 [0057.069] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0xaba0c8 [0057.069] GetTokenInformation (in: TokenHandle=0x334, TokenInformationClass=0x8, TokenInformation=0xaba0c8, TokenInformationLength=0x4, ReturnLength=0x8fe910 | out: TokenInformation=0xaba0c8, ReturnLength=0x8fe910) returned 1 [0057.070] LocalFree (hMem=0xaba0c8) returned 0x0 [0057.071] DuplicateTokenEx (in: hExistingToken=0x334, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x8fe918 | out: phNewToken=0x8fe918*=0x338) returned 1 [0057.071] CheckTokenMembership (in: TokenHandle=0x338, SidToCheck=0x26ed20c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x8fe928 | out: IsMember=0x8fe928) returned 1 [0057.071] CloseHandle (hObject=0x338) returned 1 [0057.073] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe", nBufferLength=0x105, lpBuffer=0x8fe3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe", lpFilePart=0x0) returned 0x2c [0057.073] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe", nBufferLength=0x105, lpBuffer=0x8fe3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe", lpFilePart=0x0) returned 0x2c [0057.074] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe", nBufferLength=0x105, lpBuffer=0x8fe418, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe", lpFilePart=0x0) returned 0x2c [0057.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe900) returned 1 [0057.074] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\qrej4lz7xrqqfsu3.exe"), fInfoLevelId=0x0, lpFileInformation=0x8fe97c | out: lpFileInformation=0x8fe97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b31c300, ftCreationTime.dwHighDateTime=0x1d69f56, ftLastAccessTime.dwLowDateTime=0x5bca5980, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0xeb213e00, ftLastWriteTime.dwHighDateTime=0x1d69f51, nFileSizeHigh=0x0, nFileSizeLow=0x4a000)) returned 1 [0057.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe8fc) returned 1 [0057.075] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe", nBufferLength=0x105, lpBuffer=0x8fe43c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe", lpFilePart=0x0) returned 0x2c [0057.082] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe", dwFileAttributes=0x22) returned 1 [0057.095] GetLogicalDrives () returned 0x4 [0057.096] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x8fe350, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0057.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe8b8) returned 1 [0057.096] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x8fe934 | out: lpFileInformation=0x8fe934*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x31b3b9e4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x865407b, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0x865407b, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0057.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe8b4) returned 1 [0057.104] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x8fe3a4, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0057.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe8bc) returned 1 [0057.104] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x8fe370, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0057.105] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x8fe5e4 | out: lpFindFileData=0x8fe5e4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xac1a48 [0057.106] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0057.106] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0057.108] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0057.109] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0057.109] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0057.109] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0057.109] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0057.109] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0057.109] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0057.109] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd84572f7, ftLastWriteTime.dwHighDateTime=0x1d63331, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0057.110] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0057.110] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xd9c77627, ftLastWriteTime.dwHighDateTime=0x1d63331, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0057.110] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0057.110] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dea5340, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0x1dea5340, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0057.110] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0057.110] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0057.110] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0057.110] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xd9c9d88a, ftLastWriteTime.dwHighDateTime=0x1d63331, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0057.110] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0057.111] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0057.111] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0057.111] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0057.111] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0057.111] FindClose (in: hFindFile=0xac1a48 | out: hFindFile=0xac1a48) returned 1 [0057.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe878) returned 1 [0057.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe884) returned 1 [0057.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe8bc) returned 1 [0057.117] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x8fe370, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0057.117] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x8fe5e4 | out: lpFindFileData=0x8fe5e4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xac15c8 [0057.118] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0057.118] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0057.118] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0057.119] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0057.119] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0057.119] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0057.119] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0057.119] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0057.119] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0057.119] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd84572f7, ftLastWriteTime.dwHighDateTime=0x1d63331, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0057.119] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0057.119] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xd9c77627, ftLastWriteTime.dwHighDateTime=0x1d63331, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0057.119] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0057.119] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dea5340, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0x1dea5340, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0057.120] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0057.120] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0057.120] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0057.120] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xd9c9d88a, ftLastWriteTime.dwHighDateTime=0x1d63331, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0057.120] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0057.120] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0057.120] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0057.120] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0057.120] FindNextFileW (in: hFindFile=0xac15c8, lpFindFileData=0x8fe5f0 | out: lpFindFileData=0x8fe5f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0057.120] FindClose (in: hFindFile=0xac15c8 | out: hFindFile=0xac15c8) returned 1 [0057.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe878) returned 1 [0057.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe884) returned 1 [0057.121] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212", nBufferLength=0x105, lpBuffer=0x8fe360, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212", lpFilePart=0x0) returned 0x15 [0057.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe878) returned 1 [0057.121] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212", nBufferLength=0x105, lpBuffer=0x8fe32c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212", lpFilePart=0x0) returned 0x15 [0057.121] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x8fe5a0 | out: lpFindFileData=0x8fe5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1a48 [0057.123] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.123] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1025", cAlternateFileName="")) returned 1 [0057.124] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0057.124] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1029", cAlternateFileName="")) returned 1 [0057.124] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1030", cAlternateFileName="")) returned 1 [0057.124] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0057.124] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1032", cAlternateFileName="")) returned 1 [0057.124] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0057.124] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1035", cAlternateFileName="")) returned 1 [0057.124] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0057.124] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1037", cAlternateFileName="")) returned 1 [0057.124] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1038", cAlternateFileName="")) returned 1 [0057.125] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0057.125] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0057.125] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0057.125] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1043", cAlternateFileName="")) returned 1 [0057.125] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1044", cAlternateFileName="")) returned 1 [0057.125] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1045", cAlternateFileName="")) returned 1 [0057.125] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0057.126] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0057.126] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1053", cAlternateFileName="")) returned 1 [0057.126] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1055", cAlternateFileName="")) returned 1 [0057.126] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0057.126] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1 [0057.126] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3076", cAlternateFileName="")) returned 1 [0057.126] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0057.126] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0057.126] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0057.126] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0057.127] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1 [0057.127] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graphics", cAlternateFileName="")) returned 1 [0057.127] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0057.127] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0057.127] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0057.127] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0057.127] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0057.127] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0057.127] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0057.128] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0057.128] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0057.128] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0057.128] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0057.128] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0057.129] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0057.129] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0057.129] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0057.129] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0057.129] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0057.129] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0057.129] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0057.129] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0057.129] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0057.129] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0057.129] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0057.130] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0057.130] FindNextFileW (in: hFindFile=0xac1a48, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0057.130] FindClose (in: hFindFile=0xac1a48 | out: hFindFile=0xac1a48) returned 1 [0057.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe834) returned 1 [0057.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe840) returned 1 [0057.136] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DHtmlHeader.html", lpFilePart=0x0) returned 0x26 [0057.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe780) returned 1 [0057.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x338 [0057.144] GetFileType (hFile=0x338) returned 0x1 [0057.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe77c) returned 1 [0057.144] GetFileType (hFile=0x338) returned 0x1 [0057.144] GetFileSize (in: hFile=0x338, lpFileSizeHigh=0x8fe87c | out: lpFileSizeHigh=0x8fe87c*=0x0) returned 0x3ef6 [0057.144] ReadFile (in: hFile=0x338, lpBuffer=0x26f5ce8, nNumberOfBytesToRead=0x3ef6, lpNumberOfBytesRead=0x8fe828, lpOverlapped=0x0 | out: lpBuffer=0x26f5ce8*, lpNumberOfBytesRead=0x8fe828*=0x3ef6, lpOverlapped=0x0) returned 1 [0057.145] CloseHandle (hObject=0x338) returned 1 [0060.817] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x8fe1cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0060.817] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x8fe230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0060.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e4) returned 1 [0060.817] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x8fe760 | out: lpFileInformation=0x8fe760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0060.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6e0) returned 1 [0060.956] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x8fe63c | out: pfEnabled=0x8fe63c) returned 0x0 [0061.311] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html", nBufferLength=0x105, lpBuffer=0x8fe224, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DHtmlHeader.html", lpFilePart=0x0) returned 0x26 [0061.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0061.311] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3e4 [0061.312] GetFileType (hFile=0x3e4) returned 0x1 [0061.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe764) returned 1 [0061.312] GetFileType (hFile=0x3e4) returned 0x1 [0061.312] WriteFile (in: hFile=0x3e4, lpBuffer=0x2780a14*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x8fe818, lpOverlapped=0x0 | out: lpBuffer=0x2780a14*, lpNumberOfBytesWritten=0x8fe818*=0x3f00, lpOverlapped=0x0) returned 1 [0061.313] CloseHandle (hObject=0x3e4) returned 1 [0061.315] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DHtmlHeader.html", lpFilePart=0x0) returned 0x26 [0061.315] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x51 [0061.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0061.315] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), fInfoLevelId=0x0, lpFileInformation=0x8fe87c | out: lpFileInformation=0x8fe87c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x809981f2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3f00)) returned 1 [0061.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.315] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.316] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DisplayIcon.ico", lpFilePart=0x0) returned 0x25 [0061.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe780) returned 1 [0061.316] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3e4 [0061.317] GetFileType (hFile=0x3e4) returned 0x1 [0061.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe77c) returned 1 [0061.317] GetFileType (hFile=0x3e4) returned 0x1 [0061.317] GetFileSize (in: hFile=0x3e4, lpFileSizeHigh=0x8fe87c | out: lpFileSizeHigh=0x8fe87c*=0x0) returned 0x159d5 [0061.317] ReadFile (in: hFile=0x3e4, lpBuffer=0x36c98e8, nNumberOfBytesToRead=0x159d5, lpNumberOfBytesRead=0x8fe828, lpOverlapped=0x0 | out: lpBuffer=0x36c98e8*, lpNumberOfBytesRead=0x8fe828*=0x159d5, lpOverlapped=0x0) returned 1 [0061.320] CloseHandle (hObject=0x3e4) returned 1 [0061.368] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico", nBufferLength=0x105, lpBuffer=0x8fe224, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DisplayIcon.ico", lpFilePart=0x0) returned 0x25 [0061.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0061.368] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3e4 [0061.369] GetFileType (hFile=0x3e4) returned 0x1 [0061.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe764) returned 1 [0061.369] GetFileType (hFile=0x3e4) returned 0x1 [0061.369] WriteFile (in: hFile=0x3e4, lpBuffer=0x3735a80*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x8fe818, lpOverlapped=0x0 | out: lpBuffer=0x3735a80*, lpNumberOfBytesWritten=0x8fe818*=0x159e0, lpOverlapped=0x0) returned 1 [0061.375] CloseHandle (hObject=0x3e4) returned 1 [0061.377] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DisplayIcon.ico", lpFilePart=0x0) returned 0x25 [0061.377] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x50 [0061.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0061.377] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe87c | out: lpFileInformation=0x8fe87c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80a30a72, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x159e0)) returned 1 [0061.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.377] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), lpNewFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.377] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\header.bmp", lpFilePart=0x0) returned 0x20 [0061.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe780) returned 1 [0061.378] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3e4 [0061.378] GetFileType (hFile=0x3e4) returned 0x1 [0061.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe77c) returned 1 [0061.378] GetFileType (hFile=0x3e4) returned 0x1 [0061.378] GetFileSize (in: hFile=0x3e4, lpFileSizeHigh=0x8fe87c | out: lpFileSizeHigh=0x8fe87c*=0x0) returned 0xe2c [0061.379] ReadFile (in: hFile=0x3e4, lpBuffer=0x27d2d10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe828, lpOverlapped=0x0 | out: lpBuffer=0x27d2d10*, lpNumberOfBytesRead=0x8fe828*=0xe2c, lpOverlapped=0x0) returned 1 [0061.380] CloseHandle (hObject=0x3e4) returned 1 [0061.422] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp", nBufferLength=0x105, lpBuffer=0x8fe224, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\header.bmp", lpFilePart=0x0) returned 0x20 [0061.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0061.422] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3e4 [0061.423] GetFileType (hFile=0x3e4) returned 0x1 [0061.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe764) returned 1 [0061.423] GetFileType (hFile=0x3e4) returned 0x1 [0061.423] WriteFile (in: hFile=0x3e4, lpBuffer=0x28252e0*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x8fe7ec, lpOverlapped=0x0 | out: lpBuffer=0x28252e0*, lpNumberOfBytesWritten=0x8fe7ec*=0xe30, lpOverlapped=0x0) returned 1 [0061.424] CloseHandle (hObject=0x3e4) returned 1 [0061.425] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\header.bmp", lpFilePart=0x0) returned 0x20 [0061.425] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\header.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4b [0061.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0061.425] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe87c | out: lpFileInformation=0x8fe87c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x80aa3255, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe30)) returned 1 [0061.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.425] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\header.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.425] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\ParameterInfo.xml", lpFilePart=0x0) returned 0x27 [0061.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe780) returned 1 [0061.425] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3e4 [0061.426] GetFileType (hFile=0x3e4) returned 0x1 [0061.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe77c) returned 1 [0061.426] GetFileType (hFile=0x3e4) returned 0x1 [0061.426] GetFileSize (in: hFile=0x3e4, lpFileSizeHigh=0x8fe87c | out: lpFileSizeHigh=0x8fe87c*=0x0) returned 0x426ae [0061.427] ReadFile (in: hFile=0x3e4, lpBuffer=0x374b480, nNumberOfBytesToRead=0x426ae, lpNumberOfBytesRead=0x8fe828, lpOverlapped=0x0 | out: lpBuffer=0x374b480*, lpNumberOfBytesRead=0x8fe828*=0x426ae, lpOverlapped=0x0) returned 1 [0061.434] CloseHandle (hObject=0x3e4) returned 1 [0061.493] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml", nBufferLength=0x105, lpBuffer=0x8fe224, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\ParameterInfo.xml", lpFilePart=0x0) returned 0x27 [0061.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0061.494] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3e4 [0061.496] GetFileType (hFile=0x3e4) returned 0x1 [0061.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe764) returned 1 [0061.496] GetFileType (hFile=0x3e4) returned 0x1 [0061.496] WriteFile (in: hFile=0x3e4, lpBuffer=0x3897630*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x8fe818, lpOverlapped=0x0 | out: lpBuffer=0x3897630*, lpNumberOfBytesWritten=0x8fe818*=0x426b0, lpOverlapped=0x0) returned 1 [0061.499] CloseHandle (hObject=0x3e4) returned 1 [0061.504] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\ParameterInfo.xml", lpFilePart=0x0) returned 0x27 [0061.504] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x52 [0061.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0061.504] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe87c | out: lpFileInformation=0x8fe87c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x80b61ed0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x426b0)) returned 1 [0061.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.504] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.505] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SplashScreen.bmp", lpFilePart=0x0) returned 0x26 [0061.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe780) returned 1 [0061.505] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3e4 [0061.505] GetFileType (hFile=0x3e4) returned 0x1 [0061.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe77c) returned 1 [0061.505] GetFileType (hFile=0x3e4) returned 0x1 [0061.505] GetFileSize (in: hFile=0x3e4, lpFileSizeHigh=0x8fe87c | out: lpFileSizeHigh=0x8fe87c*=0x0) returned 0xa078 [0061.505] ReadFile (in: hFile=0x3e4, lpBuffer=0x28738fc, nNumberOfBytesToRead=0xa078, lpNumberOfBytesRead=0x8fe828, lpOverlapped=0x0 | out: lpBuffer=0x28738fc*, lpNumberOfBytesRead=0x8fe828*=0xa078, lpOverlapped=0x0) returned 1 [0061.509] CloseHandle (hObject=0x3e4) returned 1 [0061.587] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x8fe224, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SplashScreen.bmp", lpFilePart=0x0) returned 0x26 [0061.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0061.587] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.588] GetFileType (hFile=0x2d0) returned 0x1 [0061.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe764) returned 1 [0061.589] GetFileType (hFile=0x2d0) returned 0x1 [0061.589] WriteFile (in: hFile=0x2d0, lpBuffer=0x2727c80*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x8fe818, lpOverlapped=0x0 | out: lpBuffer=0x2727c80*, lpNumberOfBytesWritten=0x8fe818*=0xa080, lpOverlapped=0x0) returned 1 [0061.667] CloseHandle (hObject=0x2d0) returned 1 [0061.668] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SplashScreen.bmp", lpFilePart=0x0) returned 0x26 [0061.669] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x51 [0061.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0061.669] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe87c | out: lpFileInformation=0x8fe87c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80d05994, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa080)) returned 1 [0061.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.669] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.669] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Strings.xml", lpFilePart=0x0) returned 0x21 [0061.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe780) returned 1 [0061.669] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.670] GetFileType (hFile=0x2d0) returned 0x1 [0061.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe77c) returned 1 [0061.670] GetFileType (hFile=0x2d0) returned 0x1 [0061.670] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe87c | out: lpFileSizeHigh=0x8fe87c*=0x0) returned 0x3704 [0061.670] ReadFile (in: hFile=0x2d0, lpBuffer=0x27320f0, nNumberOfBytesToRead=0x3704, lpNumberOfBytesRead=0x8fe828, lpOverlapped=0x0 | out: lpBuffer=0x27320f0*, lpNumberOfBytesRead=0x8fe828*=0x3704, lpOverlapped=0x0) returned 1 [0061.672] CloseHandle (hObject=0x2d0) returned 1 [0061.687] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml", nBufferLength=0x105, lpBuffer=0x8fe224, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Strings.xml", lpFilePart=0x0) returned 0x21 [0061.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0061.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.688] GetFileType (hFile=0x2d0) returned 0x1 [0061.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe764) returned 1 [0061.688] GetFileType (hFile=0x2d0) returned 0x1 [0061.688] WriteFile (in: hFile=0x2d0, lpBuffer=0x279039c*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x8fe818, lpOverlapped=0x0 | out: lpBuffer=0x279039c*, lpNumberOfBytesWritten=0x8fe818*=0x3710, lpOverlapped=0x0) returned 1 [0061.689] CloseHandle (hObject=0x2d0) returned 1 [0061.690] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Strings.xml", lpFilePart=0x0) returned 0x21 [0061.690] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Strings.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4c [0061.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0061.690] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe87c | out: lpFileInformation=0x8fe87c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80d2bd45, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3710)) returned 1 [0061.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.690] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Strings.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.691] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\UiInfo.xml", lpFilePart=0x0) returned 0x20 [0061.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe780) returned 1 [0061.691] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.691] GetFileType (hFile=0x2d0) returned 0x1 [0061.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe77c) returned 1 [0061.691] GetFileType (hFile=0x2d0) returned 0x1 [0061.691] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe87c | out: lpFileSizeHigh=0x8fe87c*=0x0) returned 0x97f2 [0061.691] ReadFile (in: hFile=0x2d0, lpBuffer=0x2793e50, nNumberOfBytesToRead=0x97f2, lpNumberOfBytesRead=0x8fe828, lpOverlapped=0x0 | out: lpBuffer=0x2793e50*, lpNumberOfBytesRead=0x8fe828*=0x97f2, lpOverlapped=0x0) returned 1 [0061.692] CloseHandle (hObject=0x2d0) returned 1 [0061.708] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x8fe224, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\UiInfo.xml", lpFilePart=0x0) returned 0x20 [0061.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0061.709] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.713] GetFileType (hFile=0x2d0) returned 0x1 [0061.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe764) returned 1 [0061.714] GetFileType (hFile=0x2d0) returned 0x1 [0061.714] WriteFile (in: hFile=0x2d0, lpBuffer=0x2810454*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x8fe818, lpOverlapped=0x0 | out: lpBuffer=0x2810454*, lpNumberOfBytesWritten=0x8fe818*=0x9800, lpOverlapped=0x0) returned 1 [0061.716] CloseHandle (hObject=0x2d0) returned 1 [0061.717] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\UiInfo.xml", lpFilePart=0x0) returned 0x20 [0061.717] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4b [0061.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0061.717] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe87c | out: lpFileInformation=0x8fe87c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x80d77dfc, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9800)) returned 1 [0061.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.717] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.718] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\watermark.bmp", lpFilePart=0x0) returned 0x23 [0061.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe780) returned 1 [0061.718] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.718] GetFileType (hFile=0x2d0) returned 0x1 [0061.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe77c) returned 1 [0061.718] GetFileType (hFile=0x2d0) returned 0x1 [0061.718] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe87c | out: lpFileSizeHigh=0x8fe87c*=0x0) returned 0x19688 [0061.719] ReadFile (in: hFile=0x2d0, lpBuffer=0x38d9d00, nNumberOfBytesToRead=0x19688, lpNumberOfBytesRead=0x8fe828, lpOverlapped=0x0 | out: lpBuffer=0x38d9d00*, lpNumberOfBytesRead=0x8fe828*=0x19688, lpOverlapped=0x0) returned 1 [0061.723] CloseHandle (hObject=0x2d0) returned 1 [0061.753] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp", nBufferLength=0x105, lpBuffer=0x8fe224, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\watermark.bmp", lpFilePart=0x0) returned 0x23 [0061.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0061.753] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.754] GetFileType (hFile=0x2d0) returned 0x1 [0061.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe764) returned 1 [0061.754] GetFileType (hFile=0x2d0) returned 0x1 [0061.754] WriteFile (in: hFile=0x2d0, lpBuffer=0x3958e08*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x8fe818, lpOverlapped=0x0 | out: lpBuffer=0x3958e08*, lpNumberOfBytesWritten=0x8fe818*=0x19690, lpOverlapped=0x0) returned 1 [0061.756] CloseHandle (hObject=0x2d0) returned 1 [0061.758] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\watermark.bmp", lpFilePart=0x0) returned 0x23 [0061.758] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\watermark.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0061.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0061.758] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe87c | out: lpFileInformation=0x8fe87c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x80dc456e, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x19690)) returned 1 [0061.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.758] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe878) returned 1 [0061.774] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212", nBufferLength=0x105, lpBuffer=0x8fe32c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212", lpFilePart=0x0) returned 0x15 [0061.774] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x8fe5a0 | out: lpFindFileData=0x8fe5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80dc456e, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x80dc456e, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1188 [0061.774] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80dc456e, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x80dc456e, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.775] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1025", cAlternateFileName="")) returned 1 [0061.775] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0061.775] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1029", cAlternateFileName="")) returned 1 [0061.775] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1030", cAlternateFileName="")) returned 1 [0061.776] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0061.776] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1032", cAlternateFileName="")) returned 1 [0061.776] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0061.776] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1035", cAlternateFileName="")) returned 1 [0061.776] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0061.776] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1037", cAlternateFileName="")) returned 1 [0061.776] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1038", cAlternateFileName="")) returned 1 [0061.776] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0061.776] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0061.776] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0061.776] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1043", cAlternateFileName="")) returned 1 [0061.776] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1044", cAlternateFileName="")) returned 1 [0061.777] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1045", cAlternateFileName="")) returned 1 [0061.777] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0061.777] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0061.777] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1053", cAlternateFileName="")) returned 1 [0061.777] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1055", cAlternateFileName="")) returned 1 [0061.777] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0061.777] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1 [0061.777] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3076", cAlternateFileName="")) returned 1 [0061.778] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0061.778] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0061.778] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x809981f2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHtmlHeader.html.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="DHTMLH~1.MAD")) returned 1 [0061.778] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80a30a72, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x159e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayIcon.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="DISPLA~1.MAD")) returned 1 [0061.778] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1 [0061.778] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graphics", cAlternateFileName="")) returned 1 [0061.778] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x80aa3255, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x0, cFileName="header.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HEADER~1.MAD")) returned 1 [0061.778] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0061.778] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0061.778] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0061.778] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0061.779] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0061.779] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0061.779] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x80b61ed0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x426b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParameterInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="PARAME~1.MAD")) returned 1 [0061.779] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0061.779] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0061.779] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0061.779] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0061.779] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0061.779] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0061.780] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0061.780] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80d05994, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa080, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="SPLASH~1.MAD")) returned 1 [0061.780] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0061.780] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x80d2bd45, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3710, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strings.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="STRING~1.MAD")) returned 1 [0061.780] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x80d77dfc, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9800, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UIINFO~1.MAD")) returned 1 [0061.780] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x80dc456e, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x19690, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="WATERM~1.MAD")) returned 1 [0061.780] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0061.780] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0061.780] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0061.781] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0061.781] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0061.781] FindClose (in: hFindFile=0xac1188 | out: hFindFile=0xac1188) returned 1 [0061.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe834) returned 1 [0061.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe840) returned 1 [0061.781] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025", lpFilePart=0x0) returned 0x1a [0061.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0061.781] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025", lpFilePart=0x0) returned 0x1a [0061.781] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0061.782] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.782] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.782] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.782] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.782] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.782] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0061.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0061.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.782] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\eula.rtf", lpFilePart=0x0) returned 0x23 [0061.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0061.782] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.783] GetFileType (hFile=0x2d0) returned 0x1 [0061.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0061.783] GetFileType (hFile=0x2d0) returned 0x1 [0061.783] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x1d8f [0061.783] ReadFile (in: hFile=0x2d0, lpBuffer=0x286d590, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x286d590*, lpNumberOfBytesRead=0x8fe7e4*=0x1d8f, lpOverlapped=0x0) returned 1 [0061.785] CloseHandle (hObject=0x2d0) returned 1 [0061.801] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\eula.rtf", lpFilePart=0x0) returned 0x23 [0061.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0061.801] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.803] GetFileType (hFile=0x2d0) returned 0x1 [0061.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0061.804] GetFileType (hFile=0x2d0) returned 0x1 [0061.804] WriteFile (in: hFile=0x2d0, lpBuffer=0x28c3764*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x28c3764*, lpNumberOfBytesWritten=0x8fe7d4*=0x1d90, lpOverlapped=0x0) returned 1 [0061.804] CloseHandle (hObject=0x2d0) returned 1 [0061.805] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\eula.rtf", lpFilePart=0x0) returned 0x23 [0061.805] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0061.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0061.805] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x80e36b05, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1d90)) returned 1 [0061.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0061.805] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.808] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0061.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0061.808] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.813] GetFileType (hFile=0x2d0) returned 0x1 [0061.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0061.813] GetFileType (hFile=0x2d0) returned 0x1 [0061.813] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x121e6 [0061.814] ReadFile (in: hFile=0x2d0, lpBuffer=0x28c58c8, nNumberOfBytesToRead=0x121e6, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28c58c8*, lpNumberOfBytesRead=0x8fe7e4*=0x121e6, lpOverlapped=0x0) returned 1 [0061.816] CloseHandle (hObject=0x2d0) returned 1 [0061.844] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0061.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0061.844] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.845] GetFileType (hFile=0x2d0) returned 0x1 [0061.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0061.845] GetFileType (hFile=0x2d0) returned 0x1 [0061.845] WriteFile (in: hFile=0x2d0, lpBuffer=0x2948cb0*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2948cb0*, lpNumberOfBytesWritten=0x8fe7d4*=0x121f0, lpOverlapped=0x0) returned 1 [0061.846] CloseHandle (hObject=0x2d0) returned 1 [0061.848] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0061.848] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0061.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0061.848] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x80ea928c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x121f0)) returned 1 [0061.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0061.848] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0061.849] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1025", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1025", lpFilePart=0x0) returned 0x1a [0061.849] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80ea928c, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x80ea928c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f08 [0061.849] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80ea928c, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x80ea928c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.849] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x80e36b05, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0061.849] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x80ea928c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x121f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0061.850] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.850] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.850] FindClose (in: hFindFile=0xac0f08 | out: hFindFile=0xac0f08) returned 1 [0061.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0061.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.850] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028", lpFilePart=0x0) returned 0x1a [0061.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0061.850] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028", lpFilePart=0x0) returned 0x1a [0061.850] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1188 [0061.851] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.851] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.852] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.852] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.852] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.852] FindClose (in: hFindFile=0xac1188 | out: hFindFile=0xac1188) returned 1 [0061.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0061.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.852] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\eula.rtf", lpFilePart=0x0) returned 0x23 [0061.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0061.852] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.852] GetFileType (hFile=0x2d0) returned 0x1 [0061.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0061.852] GetFileType (hFile=0x2d0) returned 0x1 [0061.852] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x18a5 [0061.852] ReadFile (in: hFile=0x2d0, lpBuffer=0x295c834, nNumberOfBytesToRead=0x18a5, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x295c834*, lpNumberOfBytesRead=0x8fe7e4*=0x18a5, lpOverlapped=0x0) returned 1 [0061.854] CloseHandle (hObject=0x2d0) returned 1 [0061.876] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\eula.rtf", lpFilePart=0x0) returned 0x23 [0061.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0061.877] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.877] GetFileType (hFile=0x2d0) returned 0x1 [0061.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0061.877] GetFileType (hFile=0x2d0) returned 0x1 [0061.877] WriteFile (in: hFile=0x2d0, lpBuffer=0x29b11a8*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x29b11a8*, lpNumberOfBytesWritten=0x8fe7d4*=0x18b0, lpOverlapped=0x0) returned 1 [0061.878] CloseHandle (hObject=0x2d0) returned 1 [0061.879] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\eula.rtf", lpFilePart=0x0) returned 0x23 [0061.879] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0061.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0061.879] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x80ef5725, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x18b0)) returned 1 [0061.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0061.879] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.882] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0061.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0061.882] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.884] GetFileType (hFile=0x2d0) returned 0x1 [0061.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0061.884] GetFileType (hFile=0x2d0) returned 0x1 [0061.884] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xed90 [0061.885] ReadFile (in: hFile=0x2d0, lpBuffer=0x29b2e2c, nNumberOfBytesToRead=0xed90, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x29b2e2c*, lpNumberOfBytesRead=0x8fe7e4*=0xed90, lpOverlapped=0x0) returned 1 [0061.886] CloseHandle (hObject=0x2d0) returned 1 [0061.912] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0061.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0061.912] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.913] GetFileType (hFile=0x2d0) returned 0x1 [0061.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0061.913] GetFileType (hFile=0x2d0) returned 0x1 [0061.913] WriteFile (in: hFile=0x2d0, lpBuffer=0x2a2c520*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2a2c520*, lpNumberOfBytesWritten=0x8fe7d4*=0xeda0, lpOverlapped=0x0) returned 1 [0061.914] CloseHandle (hObject=0x2d0) returned 1 [0061.916] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0061.916] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0061.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0061.916] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x80f41ba2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xeda0)) returned 1 [0061.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0061.916] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0061.917] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1028", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1028", lpFilePart=0x0) returned 0x1a [0061.917] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80f41ba2, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x80f41ba2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1008 [0061.917] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80f41ba2, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x80f41ba2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.917] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x80ef5725, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0061.918] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x80f41ba2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xeda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0061.918] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.918] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0061.918] FindClose (in: hFindFile=0xac1008 | out: hFindFile=0xac1008) returned 1 [0061.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0061.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.918] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029", lpFilePart=0x0) returned 0x1a [0061.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0061.918] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029", lpFilePart=0x0) returned 0x1a [0061.918] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1008 [0061.919] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.919] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0061.919] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0061.919] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0061.919] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.919] FindClose (in: hFindFile=0xac1008 | out: hFindFile=0xac1008) returned 1 [0061.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0061.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0061.920] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\eula.rtf", lpFilePart=0x0) returned 0x23 [0061.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0061.920] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.920] GetFileType (hFile=0x2d0) returned 0x1 [0061.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0061.920] GetFileType (hFile=0x2d0) returned 0x1 [0061.920] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xe8e [0061.920] ReadFile (in: hFile=0x2d0, lpBuffer=0x2a3daf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2a3daf0*, lpNumberOfBytesRead=0x8fe7e4*=0xe8e, lpOverlapped=0x0) returned 1 [0061.926] CloseHandle (hObject=0x2d0) returned 1 [0061.972] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\eula.rtf", lpFilePart=0x0) returned 0x23 [0061.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0061.972] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.973] GetFileType (hFile=0x2d0) returned 0x1 [0061.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0061.973] GetFileType (hFile=0x2d0) returned 0x1 [0061.973] WriteFile (in: hFile=0x2d0, lpBuffer=0x2a902a0*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x2a902a0*, lpNumberOfBytesWritten=0x8fe7a8*=0xe90, lpOverlapped=0x0) returned 1 [0061.974] CloseHandle (hObject=0x2d0) returned 1 [0061.974] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\eula.rtf", lpFilePart=0x0) returned 0x23 [0061.974] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0061.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0061.974] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x80fda518, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe90)) returned 1 [0061.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0061.975] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0061.976] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0061.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0061.976] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0061.976] GetFileType (hFile=0x2d0) returned 0x1 [0061.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0061.976] GetFileType (hFile=0x2d0) returned 0x1 [0061.976] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x13c4a [0061.977] ReadFile (in: hFile=0x2d0, lpBuffer=0x2a915a4, nNumberOfBytesToRead=0x13c4a, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2a915a4*, lpNumberOfBytesRead=0x8fe7e4*=0x13c4a, lpOverlapped=0x0) returned 1 [0061.981] CloseHandle (hObject=0x2d0) returned 1 [0062.010] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.049] GetFileType (hFile=0x2d0) returned 0x1 [0062.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.049] GetFileType (hFile=0x2d0) returned 0x1 [0062.049] WriteFile (in: hFile=0x2d0, lpBuffer=0x271fc00*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x271fc00*, lpNumberOfBytesWritten=0x8fe7d4*=0x13c50, lpOverlapped=0x0) returned 1 [0062.051] CloseHandle (hObject=0x2d0) returned 1 [0062.054] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.054] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.054] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x8109914f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13c50)) returned 1 [0062.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.054] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.055] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1029", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1029", lpFilePart=0x0) returned 0x1a [0062.055] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8109914f, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8109914f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f08 [0062.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8109914f, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8109914f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x80fda518, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe90, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x8109914f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.056] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.056] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.056] FindClose (in: hFindFile=0xac0f08 | out: hFindFile=0xac0f08) returned 1 [0062.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.056] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030", lpFilePart=0x0) returned 0x1a [0062.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.056] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030", lpFilePart=0x0) returned 0x1a [0062.056] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1408 [0062.058] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.058] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.058] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.058] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.058] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.058] FindClose (in: hFindFile=0xac1408 | out: hFindFile=0xac1408) returned 1 [0062.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.058] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.059] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.059] GetFileType (hFile=0x2d0) returned 0x1 [0062.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.059] GetFileType (hFile=0x2d0) returned 0x1 [0062.059] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xcf2 [0062.059] ReadFile (in: hFile=0x2d0, lpBuffer=0x2735ee4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2735ee4*, lpNumberOfBytesRead=0x8fe7e4*=0xcf2, lpOverlapped=0x0) returned 1 [0062.062] CloseHandle (hObject=0x2d0) returned 1 [0062.113] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.113] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.114] GetFileType (hFile=0x2d0) returned 0x1 [0062.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.114] GetFileType (hFile=0x2d0) returned 0x1 [0062.114] WriteFile (in: hFile=0x2d0, lpBuffer=0x278802c*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x278802c*, lpNumberOfBytesWritten=0x8fe7a8*=0xd00, lpOverlapped=0x0) returned 1 [0062.115] CloseHandle (hObject=0x2d0) returned 1 [0062.116] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.116] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.116] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81131d40, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd00)) returned 1 [0062.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.116] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.122] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.122] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.122] GetFileType (hFile=0x2d0) returned 0x1 [0062.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.122] GetFileType (hFile=0x2d0) returned 0x1 [0062.122] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x12fb4 [0062.122] ReadFile (in: hFile=0x2d0, lpBuffer=0x2789330, nNumberOfBytesToRead=0x12fb4, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2789330*, lpNumberOfBytesRead=0x8fe7e4*=0x12fb4, lpOverlapped=0x0) returned 1 [0062.124] CloseHandle (hObject=0x2d0) returned 1 [0062.153] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.153] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.154] GetFileType (hFile=0x2d0) returned 0x1 [0062.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.154] GetFileType (hFile=0x2d0) returned 0x1 [0062.154] WriteFile (in: hFile=0x2d0, lpBuffer=0x26ff10c*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x26ff10c*, lpNumberOfBytesWritten=0x8fe7d4*=0x12fc0, lpOverlapped=0x0) returned 1 [0062.155] CloseHandle (hObject=0x2d0) returned 1 [0062.158] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.158] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.158] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x811a4121, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12fc0)) returned 1 [0062.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.158] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.159] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1030", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1030", lpFilePart=0x0) returned 0x1a [0062.159] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x811a4121, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x811a4121, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0062.159] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x811a4121, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x811a4121, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.159] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81131d40, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.160] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x811a4121, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12fc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.160] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.160] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.160] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0062.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.160] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031", lpFilePart=0x0) returned 0x1a [0062.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.160] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031", lpFilePart=0x0) returned 0x1a [0062.160] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1288 [0062.162] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.162] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.162] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.162] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.162] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.162] FindClose (in: hFindFile=0xac1288 | out: hFindFile=0xac1288) returned 1 [0062.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.162] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.162] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.162] GetFileType (hFile=0x2d0) returned 0x1 [0062.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.163] GetFileType (hFile=0x2d0) returned 0x1 [0062.163] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xd5b [0062.163] ReadFile (in: hFile=0x2d0, lpBuffer=0x27147c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27147c8*, lpNumberOfBytesRead=0x8fe7e4*=0xd5b, lpOverlapped=0x0) returned 1 [0062.164] CloseHandle (hObject=0x2d0) returned 1 [0062.198] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.198] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.199] GetFileType (hFile=0x2d0) returned 0x1 [0062.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.199] GetFileType (hFile=0x2d0) returned 0x1 [0062.199] WriteFile (in: hFile=0x2d0, lpBuffer=0x2766ae8*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x2766ae8*, lpNumberOfBytesWritten=0x8fe7a8*=0xd60, lpOverlapped=0x0) returned 1 [0062.200] CloseHandle (hObject=0x2d0) returned 1 [0062.201] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.201] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.201] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81216817, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd60)) returned 1 [0062.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.201] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.203] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.203] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.203] GetFileType (hFile=0x2d0) returned 0x1 [0062.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.203] GetFileType (hFile=0x2d0) returned 0x1 [0062.203] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x141aa [0062.203] ReadFile (in: hFile=0x2d0, lpBuffer=0x2767dec, nNumberOfBytesToRead=0x141aa, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2767dec*, lpNumberOfBytesRead=0x8fe7e4*=0x141aa, lpOverlapped=0x0) returned 1 [0062.207] CloseHandle (hObject=0x2d0) returned 1 [0062.233] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.233] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.234] GetFileType (hFile=0x2d0) returned 0x1 [0062.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.234] GetFileType (hFile=0x2d0) returned 0x1 [0062.234] WriteFile (in: hFile=0x2d0, lpBuffer=0x27f1114*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x27f1114*, lpNumberOfBytesWritten=0x8fe7d4*=0x141b0, lpOverlapped=0x0) returned 1 [0062.235] CloseHandle (hObject=0x2d0) returned 1 [0062.237] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.237] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.237] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81262e56, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x141b0)) returned 1 [0062.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.237] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.238] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1031", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1031", lpFilePart=0x0) returned 0x1a [0062.238] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81262e56, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81262e56, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1248 [0062.238] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81262e56, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81262e56, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.238] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81216817, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.239] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81262e56, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x141b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.239] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.239] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.239] FindClose (in: hFindFile=0xac1248 | out: hFindFile=0xac1248) returned 1 [0062.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.239] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032", lpFilePart=0x0) returned 0x1a [0062.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.239] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032", lpFilePart=0x0) returned 0x1a [0062.239] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0062.241] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.241] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.241] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.241] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.241] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.241] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0062.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.242] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.242] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.243] GetFileType (hFile=0x2d0) returned 0x1 [0062.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.243] GetFileType (hFile=0x2d0) returned 0x1 [0062.243] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x22ac [0062.243] ReadFile (in: hFile=0x2d0, lpBuffer=0x2806c58, nNumberOfBytesToRead=0x22ac, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2806c58*, lpNumberOfBytesRead=0x8fe7e4*=0x22ac, lpOverlapped=0x0) returned 1 [0062.245] CloseHandle (hObject=0x2d0) returned 1 [0062.260] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.260] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.261] GetFileType (hFile=0x2d0) returned 0x1 [0062.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.261] GetFileType (hFile=0x2d0) returned 0x1 [0062.261] WriteFile (in: hFile=0x2d0, lpBuffer=0x285e7c8*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x285e7c8*, lpNumberOfBytesWritten=0x8fe7d4*=0x22b0, lpOverlapped=0x0) returned 1 [0062.263] CloseHandle (hObject=0x2d0) returned 1 [0062.263] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.263] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.264] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x812af943, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x22b0)) returned 1 [0062.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.264] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.265] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.265] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.265] GetFileType (hFile=0x2d0) returned 0x1 [0062.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.266] GetFileType (hFile=0x2d0) returned 0x1 [0062.266] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x1510c [0062.266] ReadFile (in: hFile=0x2d0, lpBuffer=0x3717bc8, nNumberOfBytesToRead=0x1510c, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x3717bc8*, lpNumberOfBytesRead=0x8fe7e4*=0x1510c, lpOverlapped=0x0) returned 1 [0062.269] CloseHandle (hObject=0x2d0) returned 1 [0062.289] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.289] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.290] GetFileType (hFile=0x2d0) returned 0x1 [0062.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.290] GetFileType (hFile=0x2d0) returned 0x1 [0062.290] WriteFile (in: hFile=0x2d0, lpBuffer=0x3781150*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x3781150*, lpNumberOfBytesWritten=0x8fe7d4*=0x15110, lpOverlapped=0x0) returned 1 [0062.292] CloseHandle (hObject=0x2d0) returned 1 [0062.297] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.298] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.298] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x812fb6b2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15110)) returned 1 [0062.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.298] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.298] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1032", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1032", lpFilePart=0x0) returned 0x1a [0062.298] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x812fb6b2, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x812fb6b2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1308 [0062.299] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x812fb6b2, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x812fb6b2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.299] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x812af943, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.299] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x812fb6b2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15110, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.299] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.299] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.299] FindClose (in: hFindFile=0xac1308 | out: hFindFile=0xac1308) returned 1 [0062.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.299] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033", lpFilePart=0x0) returned 0x1a [0062.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.299] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033", lpFilePart=0x0) returned 0x1a [0062.299] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0062.300] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.300] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.300] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.300] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.301] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.301] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0062.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.301] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.301] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.301] GetFileType (hFile=0x2d0) returned 0x1 [0062.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.301] GetFileType (hFile=0x2d0) returned 0x1 [0062.301] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xc74 [0062.301] ReadFile (in: hFile=0x2d0, lpBuffer=0x28b0268, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28b0268*, lpNumberOfBytesRead=0x8fe7e4*=0xc74, lpOverlapped=0x0) returned 1 [0062.302] CloseHandle (hObject=0x2d0) returned 1 [0062.338] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.338] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.340] GetFileType (hFile=0x2d0) returned 0x1 [0062.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.340] GetFileType (hFile=0x2d0) returned 0x1 [0062.340] WriteFile (in: hFile=0x2d0, lpBuffer=0x2901fd0*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x2901fd0*, lpNumberOfBytesWritten=0x8fe7a8*=0xc80, lpOverlapped=0x0) returned 1 [0062.341] CloseHandle (hObject=0x2d0) returned 1 [0062.341] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.341] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.342] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0x8136dd38, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xc80)) returned 1 [0062.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.342] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.343] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.343] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.344] GetFileType (hFile=0x2d0) returned 0x1 [0062.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.344] GetFileType (hFile=0x2d0) returned 0x1 [0062.344] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x12db0 [0062.344] ReadFile (in: hFile=0x2d0, lpBuffer=0x29032d4, nNumberOfBytesToRead=0x12db0, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x29032d4*, lpNumberOfBytesRead=0x8fe7e4*=0x12db0, lpOverlapped=0x0) returned 1 [0062.347] CloseHandle (hObject=0x2d0) returned 1 [0062.390] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.390] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.391] GetFileType (hFile=0x2d0) returned 0x1 [0062.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.391] GetFileType (hFile=0x2d0) returned 0x1 [0062.391] WriteFile (in: hFile=0x2d0, lpBuffer=0x27848c4*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x27848c4*, lpNumberOfBytesWritten=0x8fe7d4*=0x12dc0, lpOverlapped=0x0) returned 1 [0062.392] CloseHandle (hObject=0x2d0) returned 1 [0062.394] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.394] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.394] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x813e03bd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12dc0)) returned 1 [0062.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.395] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.395] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1033", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1033", lpFilePart=0x0) returned 0x1a [0062.395] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x813e03bd, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x813e03bd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1408 [0062.395] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x813e03bd, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x813e03bd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.396] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0x8136dd38, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xc80, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.396] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x813e03bd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12dc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.396] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.396] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.396] FindClose (in: hFindFile=0xac1408 | out: hFindFile=0xac1408) returned 1 [0062.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.396] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035", lpFilePart=0x0) returned 0x1a [0062.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.396] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035", lpFilePart=0x0) returned 0x1a [0062.396] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1308 [0062.397] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.397] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.397] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.397] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.397] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.397] FindClose (in: hFindFile=0xac1308 | out: hFindFile=0xac1308) returned 1 [0062.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.397] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.397] GetFileType (hFile=0x2d0) returned 0x1 [0062.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.397] GetFileType (hFile=0x2d0) returned 0x1 [0062.398] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xe76 [0062.398] ReadFile (in: hFile=0x2d0, lpBuffer=0x2799e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2799e9c*, lpNumberOfBytesRead=0x8fe7e4*=0xe76, lpOverlapped=0x0) returned 1 [0062.400] CloseHandle (hObject=0x2d0) returned 1 [0062.417] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.417] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.417] GetFileType (hFile=0x2d0) returned 0x1 [0062.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.417] GetFileType (hFile=0x2d0) returned 0x1 [0062.417] WriteFile (in: hFile=0x2d0, lpBuffer=0x27ec760*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x27ec760*, lpNumberOfBytesWritten=0x8fe7a8*=0xe80, lpOverlapped=0x0) returned 1 [0062.418] CloseHandle (hObject=0x2d0) returned 1 [0062.419] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.419] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.419] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8142c869, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe80)) returned 1 [0062.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.419] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.423] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.423] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.423] GetFileType (hFile=0x2d0) returned 0x1 [0062.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.423] GetFileType (hFile=0x2d0) returned 0x1 [0062.423] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x12cde [0062.423] ReadFile (in: hFile=0x2d0, lpBuffer=0x27eda64, nNumberOfBytesToRead=0x12cde, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27eda64*, lpNumberOfBytesRead=0x8fe7e4*=0x12cde, lpOverlapped=0x0) returned 1 [0062.425] CloseHandle (hObject=0x2d0) returned 1 [0062.444] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.444] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.445] GetFileType (hFile=0x2d0) returned 0x1 [0062.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.445] GetFileType (hFile=0x2d0) returned 0x1 [0062.445] WriteFile (in: hFile=0x2d0, lpBuffer=0x2872f1c*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2872f1c*, lpNumberOfBytesWritten=0x8fe7d4*=0x12ce0, lpOverlapped=0x0) returned 1 [0062.447] CloseHandle (hObject=0x2d0) returned 1 [0062.448] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.448] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.448] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81452d62, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12ce0)) returned 1 [0062.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.449] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.449] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1035", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1035", lpFilePart=0x0) returned 0x1a [0062.449] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81478dfe, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81478dfe, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f88 [0062.450] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81478dfe, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81478dfe, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.450] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8142c869, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe80, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.450] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81452d62, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.450] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.450] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.450] FindClose (in: hFindFile=0xac0f88 | out: hFindFile=0xac0f88) returned 1 [0062.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.450] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036", lpFilePart=0x0) returned 0x1a [0062.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.451] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036", lpFilePart=0x0) returned 0x1a [0062.451] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0062.452] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.452] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.452] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.453] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.453] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.453] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0062.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.453] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.453] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.453] GetFileType (hFile=0x2d0) returned 0x1 [0062.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.453] GetFileType (hFile=0x2d0) returned 0x1 [0062.453] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xdc6 [0062.453] ReadFile (in: hFile=0x2d0, lpBuffer=0x2888364, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2888364*, lpNumberOfBytesRead=0x8fe7e4*=0xdc6, lpOverlapped=0x0) returned 1 [0062.454] CloseHandle (hObject=0x2d0) returned 1 [0062.470] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.470] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.471] GetFileType (hFile=0x2d0) returned 0x1 [0062.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.471] GetFileType (hFile=0x2d0) returned 0x1 [0062.471] WriteFile (in: hFile=0x2d0, lpBuffer=0x28da75c*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x28da75c*, lpNumberOfBytesWritten=0x8fe7a8*=0xdd0, lpOverlapped=0x0) returned 1 [0062.472] CloseHandle (hObject=0x2d0) returned 1 [0062.472] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.472] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.472] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8149f020, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xdd0)) returned 1 [0062.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.473] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.477] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.477] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.478] GetFileType (hFile=0x2d0) returned 0x1 [0062.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.478] GetFileType (hFile=0x2d0) returned 0x1 [0062.478] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x14412 [0062.478] ReadFile (in: hFile=0x2d0, lpBuffer=0x28dba60, nNumberOfBytesToRead=0x14412, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28dba60*, lpNumberOfBytesRead=0x8fe7e4*=0x14412, lpOverlapped=0x0) returned 1 [0062.479] CloseHandle (hObject=0x2d0) returned 1 [0062.521] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.521] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.522] GetFileType (hFile=0x2d0) returned 0x1 [0062.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.522] GetFileType (hFile=0x2d0) returned 0x1 [0062.522] WriteFile (in: hFile=0x2d0, lpBuffer=0x277a078*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x277a078*, lpNumberOfBytesWritten=0x8fe7d4*=0x14420, lpOverlapped=0x0) returned 1 [0062.524] CloseHandle (hObject=0x2d0) returned 1 [0062.526] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.526] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.526] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x8151197d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x14420)) returned 1 [0062.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.526] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.527] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1036", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1036", lpFilePart=0x0) returned 0x1a [0062.527] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8151197d, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8151197d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0062.527] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8151197d, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8151197d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.527] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8149f020, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xdd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.528] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x8151197d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x14420, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.528] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.528] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.528] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0062.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.528] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037", lpFilePart=0x0) returned 0x1a [0062.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.528] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037", lpFilePart=0x0) returned 0x1a [0062.528] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f08 [0062.528] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.529] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.529] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.529] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.529] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.529] FindClose (in: hFindFile=0xac0f08 | out: hFindFile=0xac0f08) returned 1 [0062.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.529] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.529] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.529] GetFileType (hFile=0x2d0) returned 0x1 [0062.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.529] GetFileType (hFile=0x2d0) returned 0x1 [0062.529] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x1ac3 [0062.529] ReadFile (in: hFile=0x2d0, lpBuffer=0x278fe2c, nNumberOfBytesToRead=0x1ac3, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x278fe2c*, lpNumberOfBytesRead=0x8fe7e4*=0x1ac3, lpOverlapped=0x0) returned 1 [0062.530] CloseHandle (hObject=0x2d0) returned 1 [0062.546] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.546] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.546] GetFileType (hFile=0x2d0) returned 0x1 [0062.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.546] GetFileType (hFile=0x2d0) returned 0x1 [0062.546] WriteFile (in: hFile=0x2d0, lpBuffer=0x27e539c*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x27e539c*, lpNumberOfBytesWritten=0x8fe7d4*=0x1ad0, lpOverlapped=0x0) returned 1 [0062.547] CloseHandle (hObject=0x2d0) returned 1 [0062.548] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.548] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.548] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8155dc4d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1ad0)) returned 1 [0062.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.548] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.556] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.556] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.556] GetFileType (hFile=0x2d0) returned 0x1 [0062.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.556] GetFileType (hFile=0x2d0) returned 0x1 [0062.556] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x1198c [0062.557] ReadFile (in: hFile=0x2d0, lpBuffer=0x27e7240, nNumberOfBytesToRead=0x1198c, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27e7240*, lpNumberOfBytesRead=0x8fe7e4*=0x1198c, lpOverlapped=0x0) returned 1 [0062.558] CloseHandle (hObject=0x2d0) returned 1 [0062.578] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.578] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.579] GetFileType (hFile=0x2d0) returned 0x1 [0062.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.579] GetFileType (hFile=0x2d0) returned 0x1 [0062.579] WriteFile (in: hFile=0x2d0, lpBuffer=0x2868d04*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2868d04*, lpNumberOfBytesWritten=0x8fe7d4*=0x11990, lpOverlapped=0x0) returned 1 [0062.580] CloseHandle (hObject=0x2d0) returned 1 [0062.582] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.582] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.582] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x815aa18a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11990)) returned 1 [0062.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.583] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.583] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1037", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1037", lpFilePart=0x0) returned 0x1a [0062.583] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x815aa18a, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x815aa18a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0062.583] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x815aa18a, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x815aa18a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.583] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8155dc4d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.584] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x815aa18a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11990, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.584] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.584] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.584] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0062.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.584] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038", lpFilePart=0x0) returned 0x1a [0062.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.584] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038", lpFilePart=0x0) returned 0x1a [0062.584] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1208 [0062.584] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.585] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.585] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.585] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.585] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.585] FindClose (in: hFindFile=0xac1208 | out: hFindFile=0xac1208) returned 1 [0062.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.585] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.585] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.585] GetFileType (hFile=0x2d0) returned 0x1 [0062.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.585] GetFileType (hFile=0x2d0) returned 0x1 [0062.585] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x109e [0062.585] ReadFile (in: hFile=0x2d0, lpBuffer=0x287c028, nNumberOfBytesToRead=0x109e, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x287c028*, lpNumberOfBytesRead=0x8fe7e4*=0x109e, lpOverlapped=0x0) returned 1 [0062.587] CloseHandle (hObject=0x2d0) returned 1 [0062.606] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.606] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.607] GetFileType (hFile=0x2d0) returned 0x1 [0062.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.607] GetFileType (hFile=0x2d0) returned 0x1 [0062.607] WriteFile (in: hFile=0x2d0, lpBuffer=0x28ce14c*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x28ce14c*, lpNumberOfBytesWritten=0x8fe7d4*=0x10a0, lpOverlapped=0x0) returned 1 [0062.608] CloseHandle (hObject=0x2d0) returned 1 [0062.609] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.609] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.609] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x815f752b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10a0)) returned 1 [0062.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.610] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.611] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.612] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.612] GetFileType (hFile=0x2d0) returned 0x1 [0062.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.612] GetFileType (hFile=0x2d0) returned 0x1 [0062.612] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x151aa [0062.612] ReadFile (in: hFile=0x2d0, lpBuffer=0x382d320, nNumberOfBytesToRead=0x151aa, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x382d320*, lpNumberOfBytesRead=0x8fe7e4*=0x151aa, lpOverlapped=0x0) returned 1 [0062.614] CloseHandle (hObject=0x2d0) returned 1 [0062.635] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.635] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.637] GetFileType (hFile=0x2d0) returned 0x1 [0062.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.637] GetFileType (hFile=0x2d0) returned 0x1 [0062.637] WriteFile (in: hFile=0x2d0, lpBuffer=0x3896bc8*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x3896bc8*, lpNumberOfBytesWritten=0x8fe7d4*=0x151b0, lpOverlapped=0x0) returned 1 [0062.638] CloseHandle (hObject=0x2d0) returned 1 [0062.640] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.640] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.640] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81642980, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x151b0)) returned 1 [0062.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.641] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.641] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1038", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1038", lpFilePart=0x0) returned 0x1a [0062.641] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81642980, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81642980, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1548 [0062.642] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81642980, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81642980, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.642] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x815f752b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.642] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81642980, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x151b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.642] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.642] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.642] FindClose (in: hFindFile=0xac1548 | out: hFindFile=0xac1548) returned 1 [0062.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.642] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040", lpFilePart=0x0) returned 0x1a [0062.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.642] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040", lpFilePart=0x0) returned 0x1a [0062.642] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1248 [0062.643] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.643] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.643] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.643] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.643] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.644] FindClose (in: hFindFile=0xac1248 | out: hFindFile=0xac1248) returned 1 [0062.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.644] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.644] GetFileType (hFile=0x2d0) returned 0x1 [0062.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.644] GetFileType (hFile=0x2d0) returned 0x1 [0062.644] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xe3b [0062.644] ReadFile (in: hFile=0x2d0, lpBuffer=0x291eba8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x291eba8*, lpNumberOfBytesRead=0x8fe7e4*=0xe3b, lpOverlapped=0x0) returned 1 [0062.646] CloseHandle (hObject=0x2d0) returned 1 [0062.687] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.688] GetFileType (hFile=0x2d0) returned 0x1 [0062.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.688] GetFileType (hFile=0x2d0) returned 0x1 [0062.688] WriteFile (in: hFile=0x2d0, lpBuffer=0x275dc38*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x275dc38*, lpNumberOfBytesWritten=0x8fe7a8*=0xe40, lpOverlapped=0x0) returned 1 [0062.689] CloseHandle (hObject=0x2d0) returned 1 [0062.690] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.690] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.690] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x816b52d6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe40)) returned 1 [0062.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.690] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.692] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.692] GetFileType (hFile=0x2d0) returned 0x1 [0062.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.692] GetFileType (hFile=0x2d0) returned 0x1 [0062.692] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x138bc [0062.692] ReadFile (in: hFile=0x2d0, lpBuffer=0x275ef3c, nNumberOfBytesToRead=0x138bc, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x275ef3c*, lpNumberOfBytesRead=0x8fe7e4*=0x138bc, lpOverlapped=0x0) returned 1 [0062.695] CloseHandle (hObject=0x2d0) returned 1 [0062.714] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.715] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.716] GetFileType (hFile=0x2d0) returned 0x1 [0062.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.716] GetFileType (hFile=0x2d0) returned 0x1 [0062.716] WriteFile (in: hFile=0x2d0, lpBuffer=0x27e68ec*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x27e68ec*, lpNumberOfBytesWritten=0x8fe7d4*=0x138c0, lpOverlapped=0x0) returned 1 [0062.717] CloseHandle (hObject=0x2d0) returned 1 [0062.719] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.719] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.719] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81701dc9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x138c0)) returned 1 [0062.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.719] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.720] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1040", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1040", lpFilePart=0x0) returned 0x1a [0062.720] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81701dc9, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81701dc9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0062.720] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81701dc9, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81701dc9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.720] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x816b52d6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe40, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.720] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81701dc9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x138c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.720] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.720] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.721] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0062.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.721] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041", lpFilePart=0x0) returned 0x1a [0062.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.721] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041", lpFilePart=0x0) returned 0x1a [0062.721] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f08 [0062.721] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.721] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.721] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.721] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.721] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.721] FindClose (in: hFindFile=0xac0f08 | out: hFindFile=0xac0f08) returned 1 [0062.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.722] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.722] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.722] GetFileType (hFile=0x2d0) returned 0x1 [0062.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.722] GetFileType (hFile=0x2d0) returned 0x1 [0062.722] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x278d [0062.722] ReadFile (in: hFile=0x2d0, lpBuffer=0x27fbb40, nNumberOfBytesToRead=0x278d, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27fbb40*, lpNumberOfBytesRead=0x8fe7e4*=0x278d, lpOverlapped=0x0) returned 1 [0062.726] CloseHandle (hObject=0x2d0) returned 1 [0062.742] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.742] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.743] GetFileType (hFile=0x2d0) returned 0x1 [0062.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.743] GetFileType (hFile=0x2d0) returned 0x1 [0062.743] WriteFile (in: hFile=0x2d0, lpBuffer=0x2854f14*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2854f14*, lpNumberOfBytesWritten=0x8fe7d4*=0x2790, lpOverlapped=0x0) returned 1 [0062.744] CloseHandle (hObject=0x2d0) returned 1 [0062.745] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.745] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.745] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81727747, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2790)) returned 1 [0062.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.745] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.748] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.748] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.748] GetFileType (hFile=0x2d0) returned 0x1 [0062.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.748] GetFileType (hFile=0x2d0) returned 0x1 [0062.748] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x10a82 [0062.748] ReadFile (in: hFile=0x2d0, lpBuffer=0x2857a78, nNumberOfBytesToRead=0x10a82, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2857a78*, lpNumberOfBytesRead=0x8fe7e4*=0x10a82, lpOverlapped=0x0) returned 1 [0062.750] CloseHandle (hObject=0x2d0) returned 1 [0062.775] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.775] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.776] GetFileType (hFile=0x2d0) returned 0x1 [0062.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.776] GetFileType (hFile=0x2d0) returned 0x1 [0062.776] WriteFile (in: hFile=0x2d0, lpBuffer=0x28d6840*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x28d6840*, lpNumberOfBytesWritten=0x8fe7d4*=0x10a90, lpOverlapped=0x0) returned 1 [0062.778] CloseHandle (hObject=0x2d0) returned 1 [0062.780] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.780] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.780] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81799e6f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10a90)) returned 1 [0062.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.780] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.781] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1041", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1041", lpFilePart=0x0) returned 0x1a [0062.781] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81799e6f, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81799e6f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f08 [0062.781] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81799e6f, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81799e6f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.781] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81727747, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2790, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.781] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81799e6f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.781] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.781] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.782] FindClose (in: hFindFile=0xac0f08 | out: hFindFile=0xac0f08) returned 1 [0062.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.782] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042", lpFilePart=0x0) returned 0x1a [0062.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.782] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042", lpFilePart=0x0) returned 0x1a [0062.782] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1188 [0062.782] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.782] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.782] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.782] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.782] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.782] FindClose (in: hFindFile=0xac1188 | out: hFindFile=0xac1188) returned 1 [0062.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.783] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.783] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.783] GetFileType (hFile=0x2d0) returned 0x1 [0062.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.783] GetFileType (hFile=0x2d0) returned 0x1 [0062.783] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x318f [0062.783] ReadFile (in: hFile=0x2d0, lpBuffer=0x28e8c64, nNumberOfBytesToRead=0x318f, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28e8c64*, lpNumberOfBytesRead=0x8fe7e4*=0x318f, lpOverlapped=0x0) returned 1 [0062.785] CloseHandle (hObject=0x2d0) returned 1 [0062.822] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.822] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.823] GetFileType (hFile=0x2d0) returned 0x1 [0062.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.823] GetFileType (hFile=0x2d0) returned 0x1 [0062.823] WriteFile (in: hFile=0x2d0, lpBuffer=0x2747554*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2747554*, lpNumberOfBytesWritten=0x8fe7d4*=0x3190, lpOverlapped=0x0) returned 1 [0062.824] CloseHandle (hObject=0x2d0) returned 1 [0062.831] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.832] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.832] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8180c5ca, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3190)) returned 1 [0062.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.832] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.834] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.834] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.834] GetFileType (hFile=0x2d0) returned 0x1 [0062.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.834] GetFileType (hFile=0x2d0) returned 0x1 [0062.834] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xfed6 [0062.834] ReadFile (in: hFile=0x2d0, lpBuffer=0x274aab8, nNumberOfBytesToRead=0xfed6, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x274aab8*, lpNumberOfBytesRead=0x8fe7e4*=0xfed6, lpOverlapped=0x0) returned 1 [0062.838] CloseHandle (hObject=0x2d0) returned 1 [0062.860] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.860] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.861] GetFileType (hFile=0x2d0) returned 0x1 [0062.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.861] GetFileType (hFile=0x2d0) returned 0x1 [0062.861] WriteFile (in: hFile=0x2d0, lpBuffer=0x27c76cc*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x27c76cc*, lpNumberOfBytesWritten=0x8fe7d4*=0xfee0, lpOverlapped=0x0) returned 1 [0062.863] CloseHandle (hObject=0x2d0) returned 1 [0062.864] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.864] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.864] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81858c40, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfee0)) returned 1 [0062.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.865] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.865] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1042", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1042", lpFilePart=0x0) returned 0x1a [0062.865] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81858c40, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81858c40, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1548 [0062.865] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81858c40, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81858c40, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.866] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8180c5ca, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3190, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.866] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81858c40, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.866] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.866] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.866] FindClose (in: hFindFile=0xac1548 | out: hFindFile=0xac1548) returned 1 [0062.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.866] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043", lpFilePart=0x0) returned 0x1a [0062.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.866] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043", lpFilePart=0x0) returned 0x1a [0062.866] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac13c8 [0062.866] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.866] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.867] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.867] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.867] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.867] FindClose (in: hFindFile=0xac13c8 | out: hFindFile=0xac13c8) returned 1 [0062.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.867] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.867] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.868] GetFileType (hFile=0x2d0) returned 0x1 [0062.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.868] GetFileType (hFile=0x2d0) returned 0x1 [0062.868] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xdda [0062.868] ReadFile (in: hFile=0x2d0, lpBuffer=0x27d9d28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27d9d28*, lpNumberOfBytesRead=0x8fe7e4*=0xdda, lpOverlapped=0x0) returned 1 [0062.869] CloseHandle (hObject=0x2d0) returned 1 [0062.908] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.908] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.909] GetFileType (hFile=0x2d0) returned 0x1 [0062.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.909] GetFileType (hFile=0x2d0) returned 0x1 [0062.909] WriteFile (in: hFile=0x2d0, lpBuffer=0x282c16c*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x282c16c*, lpNumberOfBytesWritten=0x8fe7a8*=0xde0, lpOverlapped=0x0) returned 1 [0062.910] CloseHandle (hObject=0x2d0) returned 1 [0062.911] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.911] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.911] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x818cb4c1, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xde0)) returned 1 [0062.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.911] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.912] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.913] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.913] GetFileType (hFile=0x2d0) returned 0x1 [0062.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.913] GetFileType (hFile=0x2d0) returned 0x1 [0062.913] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x13712 [0062.913] ReadFile (in: hFile=0x2d0, lpBuffer=0x282d470, nNumberOfBytesToRead=0x13712, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x282d470*, lpNumberOfBytesRead=0x8fe7e4*=0x13712, lpOverlapped=0x0) returned 1 [0062.915] CloseHandle (hObject=0x2d0) returned 1 [0062.933] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.933] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.934] GetFileType (hFile=0x2d0) returned 0x1 [0062.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.934] GetFileType (hFile=0x2d0) returned 0x1 [0062.934] WriteFile (in: hFile=0x2d0, lpBuffer=0x28b47e8*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x28b47e8*, lpNumberOfBytesWritten=0x8fe7d4*=0x13720, lpOverlapped=0x0) returned 1 [0062.936] CloseHandle (hObject=0x2d0) returned 1 [0062.937] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.937] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0062.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.937] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x8191775a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13720)) returned 1 [0062.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.938] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.938] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1043", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1043", lpFilePart=0x0) returned 0x1a [0062.938] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8191775a, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8191775a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f08 [0062.938] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8191775a, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8191775a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.939] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x818cb4c1, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xde0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0062.939] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x8191775a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13720, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0062.939] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.939] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.939] FindClose (in: hFindFile=0xac0f08 | out: hFindFile=0xac0f08) returned 1 [0062.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.939] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044", lpFilePart=0x0) returned 0x1a [0062.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0062.939] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044", lpFilePart=0x0) returned 0x1a [0062.939] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f88 [0062.940] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.941] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0062.941] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.941] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.941] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.941] FindClose (in: hFindFile=0xac0f88 | out: hFindFile=0xac0f88) returned 1 [0062.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0062.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0062.941] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.941] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.941] GetFileType (hFile=0x2d0) returned 0x1 [0062.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.941] GetFileType (hFile=0x2d0) returned 0x1 [0062.941] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xbe6 [0062.941] ReadFile (in: hFile=0x2d0, lpBuffer=0x28ca490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28ca490*, lpNumberOfBytesRead=0x8fe7e4*=0xbe6, lpOverlapped=0x0) returned 1 [0062.945] CloseHandle (hObject=0x2d0) returned 1 [0062.977] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0062.977] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.978] GetFileType (hFile=0x2d0) returned 0x1 [0062.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0062.978] GetFileType (hFile=0x2d0) returned 0x1 [0062.978] WriteFile (in: hFile=0x2d0, lpBuffer=0x271998c*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x271998c*, lpNumberOfBytesWritten=0x8fe7a8*=0xbf0, lpOverlapped=0x0) returned 1 [0062.979] CloseHandle (hObject=0x2d0) returned 1 [0062.979] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\eula.rtf", lpFilePart=0x0) returned 0x23 [0062.980] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0062.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0062.980] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81963b3d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xbf0)) returned 1 [0062.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0062.981] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0062.983] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0062.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0062.983] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0062.983] GetFileType (hFile=0x2d0) returned 0x1 [0062.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0062.983] GetFileType (hFile=0x2d0) returned 0x1 [0062.983] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x135c0 [0062.983] ReadFile (in: hFile=0x2d0, lpBuffer=0x271ac90, nNumberOfBytesToRead=0x135c0, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x271ac90*, lpNumberOfBytesRead=0x8fe7e4*=0x135c0, lpOverlapped=0x0) returned 1 [0062.986] CloseHandle (hObject=0x2d0) returned 1 [0063.008] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.008] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.009] GetFileType (hFile=0x2d0) returned 0x1 [0063.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.009] GetFileType (hFile=0x2d0) returned 0x1 [0063.009] WriteFile (in: hFile=0x2d0, lpBuffer=0x27a1d70*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x27a1d70*, lpNumberOfBytesWritten=0x8fe7d4*=0x135d0, lpOverlapped=0x0) returned 1 [0063.011] CloseHandle (hObject=0x2d0) returned 1 [0063.013] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.013] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0063.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.013] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x819d61d8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x135d0)) returned 1 [0063.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.013] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.014] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1044", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1044", lpFilePart=0x0) returned 0x1a [0063.014] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x819d61d8, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x819d61d8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0063.014] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x819d61d8, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x819d61d8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.014] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81963b3d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xbf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0063.014] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x819d61d8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x135d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0063.014] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.014] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.014] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0063.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.015] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045", lpFilePart=0x0) returned 0x1a [0063.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.015] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045", lpFilePart=0x0) returned 0x1a [0063.015] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0063.017] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.017] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.017] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.017] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.017] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.017] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0063.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.017] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.018] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.018] GetFileType (hFile=0x2d0) returned 0x1 [0063.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.018] GetFileType (hFile=0x2d0) returned 0x1 [0063.018] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xfc8 [0063.018] ReadFile (in: hFile=0x2d0, lpBuffer=0x27b7ca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27b7ca8*, lpNumberOfBytesRead=0x8fe7e4*=0xfc8, lpOverlapped=0x0) returned 1 [0063.019] CloseHandle (hObject=0x2d0) returned 1 [0063.037] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.037] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.038] GetFileType (hFile=0x2d0) returned 0x1 [0063.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.038] GetFileType (hFile=0x2d0) returned 0x1 [0063.038] WriteFile (in: hFile=0x2d0, lpBuffer=0x280aa9c*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x280aa9c*, lpNumberOfBytesWritten=0x8fe7a8*=0xfd0, lpOverlapped=0x0) returned 1 [0063.039] CloseHandle (hObject=0x2d0) returned 1 [0063.040] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.040] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0063.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.040] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x819fc5b5, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfd0)) returned 1 [0063.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.040] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.042] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.042] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.042] GetFileType (hFile=0x2d0) returned 0x1 [0063.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.042] GetFileType (hFile=0x2d0) returned 0x1 [0063.042] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x141c6 [0063.042] ReadFile (in: hFile=0x2d0, lpBuffer=0x280bda0, nNumberOfBytesToRead=0x141c6, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x280bda0*, lpNumberOfBytesRead=0x8fe7e4*=0x141c6, lpOverlapped=0x0) returned 1 [0063.044] CloseHandle (hObject=0x2d0) returned 1 [0063.104] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.104] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.105] GetFileType (hFile=0x2d0) returned 0x1 [0063.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.105] GetFileType (hFile=0x2d0) returned 0x1 [0063.105] WriteFile (in: hFile=0x2d0, lpBuffer=0x2895128*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2895128*, lpNumberOfBytesWritten=0x8fe7d4*=0x141d0, lpOverlapped=0x0) returned 1 [0063.107] CloseHandle (hObject=0x2d0) returned 1 [0063.108] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.108] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0063.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.109] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81abaff0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x141d0)) returned 1 [0063.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.109] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.109] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1045", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1045", lpFilePart=0x0) returned 0x1a [0063.109] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81abaff0, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81abaff0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e88 [0063.110] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81abaff0, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81abaff0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.110] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x819fc5b5, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0063.110] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81abaff0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x141d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0063.110] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.110] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.110] FindClose (in: hFindFile=0xac0e88 | out: hFindFile=0xac0e88) returned 1 [0063.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.110] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046", lpFilePart=0x0) returned 0x1a [0063.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.110] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046", lpFilePart=0x0) returned 0x1a [0063.110] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac13c8 [0063.111] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.111] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.111] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.111] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.111] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.112] FindClose (in: hFindFile=0xac13c8 | out: hFindFile=0xac13c8) returned 1 [0063.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.112] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.112] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.112] GetFileType (hFile=0x2d0) returned 0x1 [0063.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.112] GetFileType (hFile=0x2d0) returned 0x1 [0063.112] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xe63 [0063.112] ReadFile (in: hFile=0x2d0, lpBuffer=0x28abafc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28abafc*, lpNumberOfBytesRead=0x8fe7e4*=0xe63, lpOverlapped=0x0) returned 1 [0063.114] CloseHandle (hObject=0x2d0) returned 1 [0063.131] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.131] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.132] GetFileType (hFile=0x2d0) returned 0x1 [0063.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.132] GetFileType (hFile=0x2d0) returned 0x1 [0063.132] WriteFile (in: hFile=0x2d0, lpBuffer=0x28fe218*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x28fe218*, lpNumberOfBytesWritten=0x8fe7a8*=0xe70, lpOverlapped=0x0) returned 1 [0063.133] CloseHandle (hObject=0x2d0) returned 1 [0063.134] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.134] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0063.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.134] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81ae11f6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe70)) returned 1 [0063.134] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.138] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.138] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.138] GetFileType (hFile=0x2d0) returned 0x1 [0063.138] GetFileType (hFile=0x2d0) returned 0x1 [0063.138] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x13b62 [0063.138] ReadFile (in: hFile=0x2d0, lpBuffer=0x28ff51c, nNumberOfBytesToRead=0x13b62, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28ff51c*, lpNumberOfBytesRead=0x8fe7e4*=0x13b62, lpOverlapped=0x0) returned 1 [0063.140] CloseHandle (hObject=0x2d0) returned 1 [0063.179] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.179] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.181] GetFileType (hFile=0x2d0) returned 0x1 [0063.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.181] GetFileType (hFile=0x2d0) returned 0x1 [0063.181] WriteFile (in: hFile=0x2d0, lpBuffer=0x279a4ec*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x279a4ec*, lpNumberOfBytesWritten=0x8fe7d4*=0x13b70, lpOverlapped=0x0) returned 1 [0063.182] CloseHandle (hObject=0x2d0) returned 1 [0063.184] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.185] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0063.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.185] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81b79c49, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13b70)) returned 1 [0063.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.185] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.185] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1046", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1046", lpFilePart=0x0) returned 0x1a [0063.185] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81b79c49, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81b79c49, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f88 [0063.186] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81b79c49, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81b79c49, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.186] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81ae11f6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0063.186] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81b79c49, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0063.186] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.186] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.186] FindClose (in: hFindFile=0xac0f88 | out: hFindFile=0xac0f88) returned 1 [0063.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.186] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049", lpFilePart=0x0) returned 0x1a [0063.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.186] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049", lpFilePart=0x0) returned 0x1a [0063.186] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1508 [0063.187] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.187] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.187] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.187] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.187] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.187] FindClose (in: hFindFile=0xac1508 | out: hFindFile=0xac1508) returned 1 [0063.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.187] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.187] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.188] GetFileType (hFile=0x2d0) returned 0x1 [0063.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.188] GetFileType (hFile=0x2d0) returned 0x1 [0063.188] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xd4b8 [0063.188] ReadFile (in: hFile=0x2d0, lpBuffer=0x27af9f0, nNumberOfBytesToRead=0xd4b8, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27af9f0*, lpNumberOfBytesRead=0x8fe7e4*=0xd4b8, lpOverlapped=0x0) returned 1 [0063.192] CloseHandle (hObject=0x2d0) returned 1 [0063.210] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.211] GetFileType (hFile=0x2d0) returned 0x1 [0063.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.211] GetFileType (hFile=0x2d0) returned 0x1 [0063.211] WriteFile (in: hFile=0x2d0, lpBuffer=0x28247a0*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x28247a0*, lpNumberOfBytesWritten=0x8fe7d4*=0xd4c0, lpOverlapped=0x0) returned 1 [0063.212] CloseHandle (hObject=0x2d0) returned 1 [0063.214] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.214] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0063.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.214] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81ba00ef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd4c0)) returned 1 [0063.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.214] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.224] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.225] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.225] GetFileType (hFile=0x2d0) returned 0x1 [0063.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.225] GetFileType (hFile=0x2d0) returned 0x1 [0063.225] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x13e4a [0063.225] ReadFile (in: hFile=0x2d0, lpBuffer=0x2832034, nNumberOfBytesToRead=0x13e4a, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2832034*, lpNumberOfBytesRead=0x8fe7e4*=0x13e4a, lpOverlapped=0x0) returned 1 [0063.227] CloseHandle (hObject=0x2d0) returned 1 [0063.256] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.256] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.257] GetFileType (hFile=0x2d0) returned 0x1 [0063.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.257] GetFileType (hFile=0x2d0) returned 0x1 [0063.257] WriteFile (in: hFile=0x2d0, lpBuffer=0x26fffc4*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x26fffc4*, lpNumberOfBytesWritten=0x8fe7d4*=0x13e50, lpOverlapped=0x0) returned 1 [0063.259] CloseHandle (hObject=0x2d0) returned 1 [0063.261] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.261] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0063.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.261] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81c125b3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13e50)) returned 1 [0063.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.261] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.262] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1049", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1049", lpFilePart=0x0) returned 0x1a [0063.262] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81c38832, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81c38832, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1288 [0063.263] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81c38832, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81c38832, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.263] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81ba00ef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0063.263] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81c125b3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13e50, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0063.263] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.263] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.263] FindClose (in: hFindFile=0xac1288 | out: hFindFile=0xac1288) returned 1 [0063.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.263] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053", lpFilePart=0x0) returned 0x1a [0063.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.263] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053", lpFilePart=0x0) returned 0x1a [0063.263] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0063.264] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.264] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.264] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.264] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.264] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.264] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0063.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.265] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.265] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.265] GetFileType (hFile=0x2d0) returned 0x1 [0063.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.265] GetFileType (hFile=0x2d0) returned 0x1 [0063.265] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xf19 [0063.265] ReadFile (in: hFile=0x2d0, lpBuffer=0x27166d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27166d0*, lpNumberOfBytesRead=0x8fe7e4*=0xf19, lpOverlapped=0x0) returned 1 [0063.266] CloseHandle (hObject=0x2d0) returned 1 [0063.300] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.301] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.301] GetFileType (hFile=0x2d0) returned 0x1 [0063.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.301] GetFileType (hFile=0x2d0) returned 0x1 [0063.301] WriteFile (in: hFile=0x2d0, lpBuffer=0x27692b0*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x27692b0*, lpNumberOfBytesWritten=0x8fe7a8*=0xf20, lpOverlapped=0x0) returned 1 [0063.302] CloseHandle (hObject=0x2d0) returned 1 [0063.303] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.303] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0063.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.303] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81c84d2e, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf20)) returned 1 [0063.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.303] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.308] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.308] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.309] GetFileType (hFile=0x2d0) returned 0x1 [0063.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.309] GetFileType (hFile=0x2d0) returned 0x1 [0063.309] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x12f70 [0063.309] ReadFile (in: hFile=0x2d0, lpBuffer=0x276a5b4, nNumberOfBytesToRead=0x12f70, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x276a5b4*, lpNumberOfBytesRead=0x8fe7e4*=0x12f70, lpOverlapped=0x0) returned 1 [0063.310] CloseHandle (hObject=0x2d0) returned 1 [0063.330] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.330] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.331] GetFileType (hFile=0x2d0) returned 0x1 [0063.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.331] GetFileType (hFile=0x2d0) returned 0x1 [0063.331] WriteFile (in: hFile=0x2d0, lpBuffer=0x27f0248*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x27f0248*, lpNumberOfBytesWritten=0x8fe7d4*=0x12f80, lpOverlapped=0x0) returned 1 [0063.333] CloseHandle (hObject=0x2d0) returned 1 [0063.334] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.334] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0063.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.334] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81cd10ef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12f80)) returned 1 [0063.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.335] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.335] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1053", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1053", lpFilePart=0x0) returned 0x1a [0063.335] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81cd10ef, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81cd10ef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e88 [0063.335] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81cd10ef, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81cd10ef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.336] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81c84d2e, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf20, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0063.336] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81cd10ef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0063.336] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.336] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.336] FindClose (in: hFindFile=0xac0e88 | out: hFindFile=0xac0e88) returned 1 [0063.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.336] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055", lpFilePart=0x0) returned 0x1a [0063.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.336] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055", lpFilePart=0x0) returned 0x1a [0063.336] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1308 [0063.337] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.337] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.337] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.337] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.337] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.337] FindClose (in: hFindFile=0xac1308 | out: hFindFile=0xac1308) returned 1 [0063.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.337] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.337] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.337] GetFileType (hFile=0x2d0) returned 0x1 [0063.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.337] GetFileType (hFile=0x2d0) returned 0x1 [0063.337] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xf13 [0063.337] ReadFile (in: hFile=0x2d0, lpBuffer=0x2805a7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2805a7c*, lpNumberOfBytesRead=0x8fe7e4*=0xf13, lpOverlapped=0x0) returned 1 [0063.339] CloseHandle (hObject=0x2d0) returned 1 [0063.374] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.374] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.375] GetFileType (hFile=0x2d0) returned 0x1 [0063.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.375] GetFileType (hFile=0x2d0) returned 0x1 [0063.375] WriteFile (in: hFile=0x2d0, lpBuffer=0x2858508*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x2858508*, lpNumberOfBytesWritten=0x8fe7a8*=0xf20, lpOverlapped=0x0) returned 1 [0063.376] CloseHandle (hObject=0x2d0) returned 1 [0063.377] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.377] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0063.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.377] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81d43b55, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf20)) returned 1 [0063.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.377] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.379] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.379] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.380] GetFileType (hFile=0x2d0) returned 0x1 [0063.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.380] GetFileType (hFile=0x2d0) returned 0x1 [0063.380] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x12c12 [0063.380] ReadFile (in: hFile=0x2d0, lpBuffer=0x285980c, nNumberOfBytesToRead=0x12c12, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x285980c*, lpNumberOfBytesRead=0x8fe7e4*=0x12c12, lpOverlapped=0x0) returned 1 [0063.385] CloseHandle (hObject=0x2d0) returned 1 [0063.407] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.407] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.408] GetFileType (hFile=0x2d0) returned 0x1 [0063.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.408] GetFileType (hFile=0x2d0) returned 0x1 [0063.408] WriteFile (in: hFile=0x2d0, lpBuffer=0x28dea84*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x28dea84*, lpNumberOfBytesWritten=0x8fe7d4*=0x12c20, lpOverlapped=0x0) returned 1 [0063.410] CloseHandle (hObject=0x2d0) returned 1 [0063.412] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.412] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0063.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.412] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81d8fd5d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12c20)) returned 1 [0063.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.412] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.413] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\1055", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\1055", lpFilePart=0x0) returned 0x1a [0063.413] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81d8fd5d, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81d8fd5d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1208 [0063.413] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81d8fd5d, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81d8fd5d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.413] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81d43b55, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf20, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0063.413] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81d8fd5d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0063.413] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.413] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.413] FindClose (in: hFindFile=0xac1208 | out: hFindFile=0xac1208) returned 1 [0063.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.414] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052", lpFilePart=0x0) returned 0x1a [0063.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.414] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052", lpFilePart=0x0) returned 0x1a [0063.414] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e88 [0063.414] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.414] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.414] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.414] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.414] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.414] FindClose (in: hFindFile=0xac0e88 | out: hFindFile=0xac0e88) returned 1 [0063.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.415] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.415] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.415] GetFileType (hFile=0x2d0) returned 0x1 [0063.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.415] GetFileType (hFile=0x2d0) returned 0x1 [0063.415] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x16c3 [0063.415] ReadFile (in: hFile=0x2d0, lpBuffer=0x28f3038, nNumberOfBytesToRead=0x16c3, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28f3038*, lpNumberOfBytesRead=0x8fe7e4*=0x16c3, lpOverlapped=0x0) returned 1 [0063.416] CloseHandle (hObject=0x2d0) returned 1 [0063.457] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.458] GetFileType (hFile=0x2d0) returned 0x1 [0063.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.458] GetFileType (hFile=0x2d0) returned 0x1 [0063.458] WriteFile (in: hFile=0x2d0, lpBuffer=0x2748d98*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2748d98*, lpNumberOfBytesWritten=0x8fe7d4*=0x16d0, lpOverlapped=0x0) returned 1 [0063.459] CloseHandle (hObject=0x2d0) returned 1 [0063.459] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.459] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0063.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.459] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81e067d4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16d0)) returned 1 [0063.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.460] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.466] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.466] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.466] GetFileType (hFile=0x2d0) returned 0x1 [0063.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.466] GetFileType (hFile=0x2d0) returned 0x1 [0063.466] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xed0c [0063.466] ReadFile (in: hFile=0x2d0, lpBuffer=0x274a83c, nNumberOfBytesToRead=0xed0c, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x274a83c*, lpNumberOfBytesRead=0x8fe7e4*=0xed0c, lpOverlapped=0x0) returned 1 [0063.468] CloseHandle (hObject=0x2d0) returned 1 [0063.487] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.487] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.488] GetFileType (hFile=0x2d0) returned 0x1 [0063.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.488] GetFileType (hFile=0x2d0) returned 0x1 [0063.488] WriteFile (in: hFile=0x2d0, lpBuffer=0x27c3edc*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x27c3edc*, lpNumberOfBytesWritten=0x8fe7d4*=0xed10, lpOverlapped=0x0) returned 1 [0063.489] CloseHandle (hObject=0x2d0) returned 1 [0063.491] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.491] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0063.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.491] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81e4e8ad, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xed10)) returned 1 [0063.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.491] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.491] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2052", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2052", lpFilePart=0x0) returned 0x1a [0063.491] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81e4e8ad, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81e4e8ad, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1008 [0063.492] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81e4e8ad, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81e4e8ad, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.492] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81e067d4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0063.492] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81e4e8ad, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xed10, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0063.492] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.492] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.492] FindClose (in: hFindFile=0xac1008 | out: hFindFile=0xac1008) returned 1 [0063.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.492] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070", lpFilePart=0x0) returned 0x1a [0063.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.492] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070", lpFilePart=0x0) returned 0x1a [0063.492] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1548 [0063.493] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.493] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.493] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.493] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.493] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.493] FindClose (in: hFindFile=0xac1548 | out: hFindFile=0xac1548) returned 1 [0063.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.493] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.493] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.494] GetFileType (hFile=0x2d0) returned 0x1 [0063.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.494] GetFileType (hFile=0x2d0) returned 0x1 [0063.494] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xfaf [0063.494] ReadFile (in: hFile=0x2d0, lpBuffer=0x27d553c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27d553c*, lpNumberOfBytesRead=0x8fe7e4*=0xfaf, lpOverlapped=0x0) returned 1 [0063.495] CloseHandle (hObject=0x2d0) returned 1 [0063.512] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.512] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.513] GetFileType (hFile=0x2d0) returned 0x1 [0063.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.513] GetFileType (hFile=0x2d0) returned 0x1 [0063.513] WriteFile (in: hFile=0x2d0, lpBuffer=0x282828c*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x282828c*, lpNumberOfBytesWritten=0x8fe7a8*=0xfb0, lpOverlapped=0x0) returned 1 [0063.514] CloseHandle (hObject=0x2d0) returned 1 [0063.515] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.515] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0063.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.515] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81e9ae1a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfb0)) returned 1 [0063.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.515] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.517] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.517] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.517] GetFileType (hFile=0x2d0) returned 0x1 [0063.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.517] GetFileType (hFile=0x2d0) returned 0x1 [0063.517] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x1397e [0063.517] ReadFile (in: hFile=0x2d0, lpBuffer=0x2829590, nNumberOfBytesToRead=0x1397e, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2829590*, lpNumberOfBytesRead=0x8fe7e4*=0x1397e, lpOverlapped=0x0) returned 1 [0063.519] CloseHandle (hObject=0x2d0) returned 1 [0063.537] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.537] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.538] GetFileType (hFile=0x2d0) returned 0x1 [0063.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.538] GetFileType (hFile=0x2d0) returned 0x1 [0063.538] WriteFile (in: hFile=0x2d0, lpBuffer=0x28b1028*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x28b1028*, lpNumberOfBytesWritten=0x8fe7d4*=0x13980, lpOverlapped=0x0) returned 1 [0063.540] CloseHandle (hObject=0x2d0) returned 1 [0063.541] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.541] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0063.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.542] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81ec1037, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13980)) returned 1 [0063.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.542] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.542] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\2070", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\2070", lpFilePart=0x0) returned 0x1a [0063.542] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81ec1037, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81ec1037, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1008 [0063.574] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x81ec1037, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x81ec1037, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.574] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81e9ae1a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0063.575] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x81ec1037, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13980, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0063.575] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.575] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.575] FindClose (in: hFindFile=0xac1008 | out: hFindFile=0xac1008) returned 1 [0063.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.575] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076", lpFilePart=0x0) returned 0x1a [0063.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.575] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076", lpFilePart=0x0) returned 0x1a [0063.575] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1548 [0063.575] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.575] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.576] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.576] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.576] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.576] FindClose (in: hFindFile=0xac1548 | out: hFindFile=0xac1548) returned 1 [0063.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.576] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.576] GetFileType (hFile=0x2d0) returned 0x1 [0063.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.576] GetFileType (hFile=0x2d0) returned 0x1 [0063.576] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x18a5 [0063.576] ReadFile (in: hFile=0x2d0, lpBuffer=0x28c633c, nNumberOfBytesToRead=0x18a5, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28c633c*, lpNumberOfBytesRead=0x8fe7e4*=0x18a5, lpOverlapped=0x0) returned 1 [0063.581] CloseHandle (hObject=0x2d0) returned 1 [0063.618] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.618] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.619] GetFileType (hFile=0x2d0) returned 0x1 [0063.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.619] GetFileType (hFile=0x2d0) returned 0x1 [0063.619] WriteFile (in: hFile=0x2d0, lpBuffer=0x271f9d4*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x271f9d4*, lpNumberOfBytesWritten=0x8fe7d4*=0x18b0, lpOverlapped=0x0) returned 1 [0063.620] CloseHandle (hObject=0x2d0) returned 1 [0063.620] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.620] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0063.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.620] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81f7fd46, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x18b0)) returned 1 [0063.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.620] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.654] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.654] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.655] GetFileType (hFile=0x2d0) returned 0x1 [0063.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.655] GetFileType (hFile=0x2d0) returned 0x1 [0063.655] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xed90 [0063.655] ReadFile (in: hFile=0x2d0, lpBuffer=0x2721658, nNumberOfBytesToRead=0xed90, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2721658*, lpNumberOfBytesRead=0x8fe7e4*=0xed90, lpOverlapped=0x0) returned 1 [0063.656] CloseHandle (hObject=0x2d0) returned 1 [0063.673] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.673] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.674] GetFileType (hFile=0x2d0) returned 0x1 [0063.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.674] GetFileType (hFile=0x2d0) returned 0x1 [0063.674] WriteFile (in: hFile=0x2d0, lpBuffer=0x279aea8*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x279aea8*, lpNumberOfBytesWritten=0x8fe7d4*=0xeda0, lpOverlapped=0x0) returned 1 [0063.676] CloseHandle (hObject=0x2d0) returned 1 [0063.677] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.677] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0063.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.677] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x820187dd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xeda0)) returned 1 [0063.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.677] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.677] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3076", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3076", lpFilePart=0x0) returned 0x1a [0063.677] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x820187dd, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x820187dd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1408 [0063.678] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x820187dd, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x820187dd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.678] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x81f7fd46, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0063.678] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x820187dd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xeda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0063.678] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.678] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.678] FindClose (in: hFindFile=0xac1408 | out: hFindFile=0xac1408) returned 1 [0063.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.678] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082", lpFilePart=0x0) returned 0x1a [0063.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.678] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082", lpFilePart=0x0) returned 0x1a [0063.678] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0063.679] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.679] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0063.679] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0063.679] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.679] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.679] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0063.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.679] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.679] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.679] GetFileType (hFile=0x2d0) returned 0x1 [0063.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.679] GetFileType (hFile=0x2d0) returned 0x1 [0063.680] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xbfd [0063.680] ReadFile (in: hFile=0x2d0, lpBuffer=0x27ac1e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27ac1e8*, lpNumberOfBytesRead=0x8fe7e4*=0xbfd, lpOverlapped=0x0) returned 1 [0063.681] CloseHandle (hObject=0x2d0) returned 1 [0063.696] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.696] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.697] GetFileType (hFile=0x2d0) returned 0x1 [0063.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.697] GetFileType (hFile=0x2d0) returned 0x1 [0063.697] WriteFile (in: hFile=0x2d0, lpBuffer=0x27fdcc8*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x27fdcc8*, lpNumberOfBytesWritten=0x8fe7a8*=0xc00, lpOverlapped=0x0) returned 1 [0063.698] CloseHandle (hObject=0x2d0) returned 1 [0063.698] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\eula.rtf", lpFilePart=0x0) returned 0x23 [0063.698] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0063.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.746] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8203e789, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1 [0063.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.746] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.749] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.749] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.749] GetFileType (hFile=0x2d0) returned 0x1 [0063.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.749] GetFileType (hFile=0x2d0) returned 0x1 [0063.749] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x1387c [0063.749] ReadFile (in: hFile=0x2d0, lpBuffer=0x27fefcc, nNumberOfBytesToRead=0x1387c, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27fefcc*, lpNumberOfBytesRead=0x8fe7e4*=0x1387c, lpOverlapped=0x0) returned 1 [0063.751] CloseHandle (hObject=0x2d0) returned 1 [0063.770] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.770] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.771] GetFileType (hFile=0x2d0) returned 0x1 [0063.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.771] GetFileType (hFile=0x2d0) returned 0x1 [0063.771] WriteFile (in: hFile=0x2d0, lpBuffer=0x2886760*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2886760*, lpNumberOfBytesWritten=0x8fe7d4*=0x13880, lpOverlapped=0x0) returned 1 [0063.773] CloseHandle (hObject=0x2d0) returned 1 [0063.777] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", lpFilePart=0x0) returned 0x2c [0063.777] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0063.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.777] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x820fd379, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13880)) returned 1 [0063.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.777] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.778] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\3082", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\3082", lpFilePart=0x0) returned 0x1a [0063.778] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x821236d5, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x821236d5, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0063.778] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x821236d5, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x821236d5, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.778] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8203e789, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULART~1.MAD")) returned 1 [0063.778] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x820fd379, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13880, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCALI~1.MAD")) returned 1 [0063.778] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0063.779] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0063.779] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0063.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.779] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client", lpFilePart=0x0) returned 0x1c [0063.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.779] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client", lpFilePart=0x0) returned 0x1c [0063.779] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0063.780] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.780] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0063.780] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0063.780] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.780] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0063.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.780] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", lpFilePart=0x0) returned 0x2e [0063.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.781] GetFileType (hFile=0x2d0) returned 0x1 [0063.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.781] GetFileType (hFile=0x2d0) returned 0x1 [0063.781] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x31444 [0063.781] ReadFile (in: hFile=0x2d0, lpBuffer=0x37c6628, nNumberOfBytesToRead=0x31444, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x37c6628*, lpNumberOfBytesRead=0x8fe7e4*=0x31444, lpOverlapped=0x0) returned 1 [0063.825] CloseHandle (hObject=0x2d0) returned 1 [0063.853] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", lpFilePart=0x0) returned 0x2e [0063.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.853] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.854] GetFileType (hFile=0x2d0) returned 0x1 [0063.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.855] GetFileType (hFile=0x2d0) returned 0x1 [0063.855] WriteFile (in: hFile=0x2d0, lpBuffer=0x38bcbe8*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x38bcbe8*, lpNumberOfBytesWritten=0x8fe7d4*=0x31450, lpOverlapped=0x0) returned 1 [0063.861] CloseHandle (hObject=0x2d0) returned 1 [0063.864] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", lpFilePart=0x0) returned 0x2e [0063.864] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x59 [0063.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.864] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x821e2183, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x31450)) returned 1 [0063.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.864] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.865] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", lpFilePart=0x0) returned 0x27 [0063.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.865] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.865] GetFileType (hFile=0x2d0) returned 0x1 [0063.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.865] GetFileType (hFile=0x2d0) returned 0x1 [0063.865] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x9882 [0063.865] ReadFile (in: hFile=0x2d0, lpBuffer=0x28e8a2c, nNumberOfBytesToRead=0x9882, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28e8a2c*, lpNumberOfBytesRead=0x8fe7e4*=0x9882, lpOverlapped=0x0) returned 1 [0063.902] CloseHandle (hObject=0x2d0) returned 1 [0063.939] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", lpFilePart=0x0) returned 0x27 [0063.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0063.939] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.940] GetFileType (hFile=0x2d0) returned 0x1 [0063.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0063.940] GetFileType (hFile=0x2d0) returned 0x1 [0063.940] WriteFile (in: hFile=0x2d0, lpBuffer=0x27722fc*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x27722fc*, lpNumberOfBytesWritten=0x8fe7d4*=0x9890, lpOverlapped=0x0) returned 1 [0063.941] CloseHandle (hObject=0x2d0) returned 1 [0063.943] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", lpFilePart=0x0) returned 0x27 [0063.943] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x52 [0063.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0063.943] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x822a0ff8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9890)) returned 1 [0063.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0063.943] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0063.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.943] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Client", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Client", lpFilePart=0x0) returned 0x1c [0063.943] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x822a0ff8, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x822a0ff8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1188 [0063.944] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x822a0ff8, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x822a0ff8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.944] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x821e2183, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x31450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="PARAME~1.MAD")) returned 1 [0063.944] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x822a0ff8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9890, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UIINFO~1.MAD")) returned 1 [0063.944] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x822a0ff8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9890, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UIINFO~1.MAD")) returned 0 [0063.944] FindClose (in: hFindFile=0xac1188 | out: hFindFile=0xac1188) returned 1 [0063.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.944] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended", lpFilePart=0x0) returned 0x1e [0063.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0063.944] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended", lpFilePart=0x0) returned 0x1e [0063.944] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f88 [0063.945] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.945] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0063.945] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0063.945] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.945] FindClose (in: hFindFile=0xac0f88 | out: hFindFile=0xac0f88) returned 1 [0063.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0063.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0063.945] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", lpFilePart=0x0) returned 0x30 [0063.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0063.945] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0063.945] GetFileType (hFile=0x2d0) returned 0x1 [0063.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0063.945] GetFileType (hFile=0x2d0) returned 0x1 [0063.945] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x16c82 [0063.946] ReadFile (in: hFile=0x2d0, lpBuffer=0x38ee058, nNumberOfBytesToRead=0x16c82, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x38ee058*, lpNumberOfBytesRead=0x8fe7e4*=0x16c82, lpOverlapped=0x0) returned 1 [0063.981] CloseHandle (hObject=0x2d0) returned 1 [0064.020] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", lpFilePart=0x0) returned 0x30 [0064.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.021] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.022] GetFileType (hFile=0x2d0) returned 0x1 [0064.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.022] GetFileType (hFile=0x2d0) returned 0x1 [0064.022] WriteFile (in: hFile=0x2d0, lpBuffer=0x395ff58*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x395ff58*, lpNumberOfBytesWritten=0x8fe7d4*=0x16c90, lpOverlapped=0x0) returned 1 [0064.023] CloseHandle (hObject=0x2d0) returned 1 [0064.025] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", lpFilePart=0x0) returned 0x30 [0064.025] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5b [0064.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.025] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x8235f98f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16c90)) returned 1 [0064.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.026] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.026] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", lpFilePart=0x0) returned 0x29 [0064.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.026] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.027] GetFileType (hFile=0x2d0) returned 0x1 [0064.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.077] GetFileType (hFile=0x2d0) returned 0x1 [0064.077] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x988a [0064.077] ReadFile (in: hFile=0x2d0, lpBuffer=0x27ca694, nNumberOfBytesToRead=0x988a, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27ca694*, lpNumberOfBytesRead=0x8fe7e4*=0x988a, lpOverlapped=0x0) returned 1 [0064.079] CloseHandle (hObject=0x2d0) returned 1 [0064.199] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", lpFilePart=0x0) returned 0x29 [0064.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.200] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.201] GetFileType (hFile=0x2d0) returned 0x1 [0064.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.201] GetFileType (hFile=0x2d0) returned 0x1 [0064.201] WriteFile (in: hFile=0x2d0, lpBuffer=0x2846f68*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2846f68*, lpNumberOfBytesWritten=0x8fe7d4*=0x9890, lpOverlapped=0x0) returned 1 [0064.202] CloseHandle (hObject=0x2d0) returned 1 [0064.204] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", lpFilePart=0x0) returned 0x29 [0064.204] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x54 [0064.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.204] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x82535820, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9890)) returned 1 [0064.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.204] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0064.205] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Extended", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Extended", lpFilePart=0x0) returned 0x1e [0064.205] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x82537d94, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x82537d94, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1188 [0064.205] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x82537d94, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x82537d94, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.205] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x8235f98f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16c90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="PARAME~1.MAD")) returned 1 [0064.206] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x82535820, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9890, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UIINFO~1.MAD")) returned 1 [0064.206] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x82535820, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9890, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UIINFO~1.MAD")) returned 0 [0064.206] FindClose (in: hFindFile=0xac1188 | out: hFindFile=0xac1188) returned 1 [0064.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0064.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0064.206] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics", lpFilePart=0x0) returned 0x1e [0064.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0064.206] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics", lpFilePart=0x0) returned 0x1e [0064.206] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1188 [0064.209] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.209] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0064.209] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0064.209] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0064.209] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0064.209] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0064.210] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0064.210] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0064.210] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0064.210] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0064.210] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0064.210] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0064.210] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0064.210] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0064.210] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0064.210] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0064.210] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.210] FindClose (in: hFindFile=0xac1188 | out: hFindFile=0xac1188) returned 1 [0064.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0064.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0064.211] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Print.ico", lpFilePart=0x0) returned 0x28 [0064.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.211] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.213] GetFileType (hFile=0x2d0) returned 0x1 [0064.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.213] GetFileType (hFile=0x2d0) returned 0x1 [0064.213] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x47e [0064.213] ReadFile (in: hFile=0x2d0, lpBuffer=0x28539e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28539e0*, lpNumberOfBytesRead=0x8fe7e4*=0x47e, lpOverlapped=0x0) returned 1 [0064.221] CloseHandle (hObject=0x2d0) returned 1 [0064.244] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Print.ico", lpFilePart=0x0) returned 0x28 [0064.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.244] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.245] GetFileType (hFile=0x2d0) returned 0x1 [0064.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.245] GetFileType (hFile=0x2d0) returned 0x1 [0064.245] WriteFile (in: hFile=0x2d0, lpBuffer=0x28a2f4c*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x28a2f4c*, lpNumberOfBytesWritten=0x8fe7a8*=0x480, lpOverlapped=0x0) returned 1 [0064.245] CloseHandle (hObject=0x2d0) returned 1 [0064.246] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Print.ico", lpFilePart=0x0) returned 0x28 [0064.246] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x53 [0064.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.246] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x8257f9b4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x480)) returned 1 [0064.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.247] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.247] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", lpFilePart=0x0) returned 0x2a [0064.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.247] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.247] GetFileType (hFile=0x2d0) returned 0x1 [0064.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.247] GetFileType (hFile=0x2d0) returned 0x1 [0064.247] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x37e [0064.248] ReadFile (in: hFile=0x2d0, lpBuffer=0x28a45e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28a45e8*, lpNumberOfBytesRead=0x8fe7e4*=0x37e, lpOverlapped=0x0) returned 1 [0064.249] CloseHandle (hObject=0x2d0) returned 1 [0064.265] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", lpFilePart=0x0) returned 0x2a [0064.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.265] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.313] GetFileType (hFile=0x2d0) returned 0x1 [0064.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.313] GetFileType (hFile=0x2d0) returned 0x1 [0064.313] WriteFile (in: hFile=0x2d0, lpBuffer=0x28f365c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x28f365c*, lpNumberOfBytesWritten=0x8fe7a8*=0x380, lpOverlapped=0x0) returned 1 [0064.314] CloseHandle (hObject=0x2d0) returned 1 [0064.314] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", lpFilePart=0x0) returned 0x2a [0064.314] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x55 [0064.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.314] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x8263e9a7, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0064.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.315] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.315] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", lpFilePart=0x0) returned 0x2a [0064.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.315] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.315] GetFileType (hFile=0x2d0) returned 0x1 [0064.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.315] GetFileType (hFile=0x2d0) returned 0x1 [0064.315] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x37e [0064.315] ReadFile (in: hFile=0x2d0, lpBuffer=0x28f4d04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28f4d04*, lpNumberOfBytesRead=0x8fe7e4*=0x37e, lpOverlapped=0x0) returned 1 [0064.318] CloseHandle (hObject=0x2d0) returned 1 [0064.353] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", lpFilePart=0x0) returned 0x2a [0064.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.354] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.356] GetFileType (hFile=0x2d0) returned 0x1 [0064.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.356] GetFileType (hFile=0x2d0) returned 0x1 [0064.356] WriteFile (in: hFile=0x2d0, lpBuffer=0x27582a8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x27582a8*, lpNumberOfBytesWritten=0x8fe7a8*=0x380, lpOverlapped=0x0) returned 1 [0064.357] CloseHandle (hObject=0x2d0) returned 1 [0064.358] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", lpFilePart=0x0) returned 0x2a [0064.358] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x55 [0064.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.358] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x8268ad8f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0064.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.358] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.359] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", lpFilePart=0x0) returned 0x2a [0064.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.359] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.359] GetFileType (hFile=0x2d0) returned 0x1 [0064.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.360] GetFileType (hFile=0x2d0) returned 0x1 [0064.360] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x37e [0064.360] ReadFile (in: hFile=0x2d0, lpBuffer=0x2759950, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x2759950*, lpNumberOfBytesRead=0x8fe7e4*=0x37e, lpOverlapped=0x0) returned 1 [0064.362] CloseHandle (hObject=0x2d0) returned 1 [0064.381] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", lpFilePart=0x0) returned 0x2a [0064.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.381] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.382] GetFileType (hFile=0x2d0) returned 0x1 [0064.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.382] GetFileType (hFile=0x2d0) returned 0x1 [0064.382] WriteFile (in: hFile=0x2d0, lpBuffer=0x27a8b20*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x27a8b20*, lpNumberOfBytesWritten=0x8fe7a8*=0x380, lpOverlapped=0x0) returned 1 [0064.383] CloseHandle (hObject=0x2d0) returned 1 [0064.383] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", lpFilePart=0x0) returned 0x2a [0064.384] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x55 [0064.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.384] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x826e4aef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0064.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.384] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.384] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", lpFilePart=0x0) returned 0x2a [0064.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.384] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.385] GetFileType (hFile=0x2d0) returned 0x1 [0064.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.385] GetFileType (hFile=0x2d0) returned 0x1 [0064.385] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x37e [0064.385] ReadFile (in: hFile=0x2d0, lpBuffer=0x27aa1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27aa1c8*, lpNumberOfBytesRead=0x8fe7e4*=0x37e, lpOverlapped=0x0) returned 1 [0064.386] CloseHandle (hObject=0x2d0) returned 1 [0064.436] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", lpFilePart=0x0) returned 0x2a [0064.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.436] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.437] GetFileType (hFile=0x2d0) returned 0x1 [0064.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.437] GetFileType (hFile=0x2d0) returned 0x1 [0064.437] WriteFile (in: hFile=0x2d0, lpBuffer=0x27f923c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x27f923c*, lpNumberOfBytesWritten=0x8fe7a8*=0x380, lpOverlapped=0x0) returned 1 [0064.438] CloseHandle (hObject=0x2d0) returned 1 [0064.438] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", lpFilePart=0x0) returned 0x2a [0064.438] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x55 [0064.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.439] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x827574b2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0064.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.439] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.439] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", lpFilePart=0x0) returned 0x2a [0064.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.439] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.439] GetFileType (hFile=0x2d0) returned 0x1 [0064.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.440] GetFileType (hFile=0x2d0) returned 0x1 [0064.440] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x37e [0064.440] ReadFile (in: hFile=0x2d0, lpBuffer=0x27fa8e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x27fa8e4*, lpNumberOfBytesRead=0x8fe7e4*=0x37e, lpOverlapped=0x0) returned 1 [0064.442] CloseHandle (hObject=0x2d0) returned 1 [0064.457] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", lpFilePart=0x0) returned 0x2a [0064.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.458] GetFileType (hFile=0x2d0) returned 0x1 [0064.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.458] GetFileType (hFile=0x2d0) returned 0x1 [0064.458] WriteFile (in: hFile=0x2d0, lpBuffer=0x2849958*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x2849958*, lpNumberOfBytesWritten=0x8fe7a8*=0x380, lpOverlapped=0x0) returned 1 [0064.459] CloseHandle (hObject=0x2d0) returned 1 [0064.459] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", lpFilePart=0x0) returned 0x2a [0064.459] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x55 [0064.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.459] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x827a3908, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0064.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.460] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.460] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", lpFilePart=0x0) returned 0x2a [0064.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.460] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.460] GetFileType (hFile=0x2d0) returned 0x1 [0064.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.460] GetFileType (hFile=0x2d0) returned 0x1 [0064.461] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x37e [0064.461] ReadFile (in: hFile=0x2d0, lpBuffer=0x284b000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x284b000*, lpNumberOfBytesRead=0x8fe7e4*=0x37e, lpOverlapped=0x0) returned 1 [0064.506] CloseHandle (hObject=0x2d0) returned 1 [0064.521] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", lpFilePart=0x0) returned 0x2a [0064.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.521] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.522] GetFileType (hFile=0x2d0) returned 0x1 [0064.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.522] GetFileType (hFile=0x2d0) returned 0x1 [0064.522] WriteFile (in: hFile=0x2d0, lpBuffer=0x289a074*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x289a074*, lpNumberOfBytesWritten=0x8fe7a8*=0x380, lpOverlapped=0x0) returned 1 [0064.523] CloseHandle (hObject=0x2d0) returned 1 [0064.523] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", lpFilePart=0x0) returned 0x2a [0064.524] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x55 [0064.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.524] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x8283c3a3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0064.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.524] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.524] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", lpFilePart=0x0) returned 0x2a [0064.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.524] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.525] GetFileType (hFile=0x2d0) returned 0x1 [0064.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.525] GetFileType (hFile=0x2d0) returned 0x1 [0064.525] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x37e [0064.525] ReadFile (in: hFile=0x2d0, lpBuffer=0x289b71c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x289b71c*, lpNumberOfBytesRead=0x8fe7e4*=0x37e, lpOverlapped=0x0) returned 1 [0064.527] CloseHandle (hObject=0x2d0) returned 1 [0064.543] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", lpFilePart=0x0) returned 0x2a [0064.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.543] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.543] GetFileType (hFile=0x2d0) returned 0x1 [0064.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.544] GetFileType (hFile=0x2d0) returned 0x1 [0064.544] WriteFile (in: hFile=0x2d0, lpBuffer=0x28ea790*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x28ea790*, lpNumberOfBytesWritten=0x8fe7a8*=0x380, lpOverlapped=0x0) returned 1 [0064.544] CloseHandle (hObject=0x2d0) returned 1 [0064.545] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", lpFilePart=0x0) returned 0x2a [0064.545] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x55 [0064.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.545] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x828624ea, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0064.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.545] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.546] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", lpFilePart=0x0) returned 0x2a [0064.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.546] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.584] GetFileType (hFile=0x2d0) returned 0x1 [0064.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.584] GetFileType (hFile=0x2d0) returned 0x1 [0064.584] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x37e [0064.584] ReadFile (in: hFile=0x2d0, lpBuffer=0x28ebe38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28ebe38*, lpNumberOfBytesRead=0x8fe7e4*=0x37e, lpOverlapped=0x0) returned 1 [0064.586] CloseHandle (hObject=0x2d0) returned 1 [0064.606] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", lpFilePart=0x0) returned 0x2a [0064.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.606] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.607] GetFileType (hFile=0x2d0) returned 0x1 [0064.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.607] GetFileType (hFile=0x2d0) returned 0x1 [0064.608] WriteFile (in: hFile=0x2d0, lpBuffer=0x273af08*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x273af08*, lpNumberOfBytesWritten=0x8fe7a8*=0x380, lpOverlapped=0x0) returned 1 [0064.610] CloseHandle (hObject=0x2d0) returned 1 [0064.610] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", lpFilePart=0x0) returned 0x2a [0064.610] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x55 [0064.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.610] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x828fb018, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380)) returned 1 [0064.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.611] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.611] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Save.ico", lpFilePart=0x0) returned 0x27 [0064.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.611] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.612] GetFileType (hFile=0x2d0) returned 0x1 [0064.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.612] GetFileType (hFile=0x2d0) returned 0x1 [0064.612] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x47e [0064.612] ReadFile (in: hFile=0x2d0, lpBuffer=0x273c6a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x273c6a4*, lpNumberOfBytesRead=0x8fe7e4*=0x47e, lpOverlapped=0x0) returned 1 [0064.613] CloseHandle (hObject=0x2d0) returned 1 [0064.628] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Save.ico", lpFilePart=0x0) returned 0x27 [0064.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.628] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.629] GetFileType (hFile=0x2d0) returned 0x1 [0064.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.629] GetFileType (hFile=0x2d0) returned 0x1 [0064.629] WriteFile (in: hFile=0x2d0, lpBuffer=0x278bd68*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x278bd68*, lpNumberOfBytesWritten=0x8fe7a8*=0x480, lpOverlapped=0x0) returned 1 [0064.630] CloseHandle (hObject=0x2d0) returned 1 [0064.662] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Save.ico", lpFilePart=0x0) returned 0x27 [0064.662] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x52 [0064.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.662] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x82993810, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x480)) returned 1 [0064.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.662] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.663] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", lpFilePart=0x0) returned 0x28 [0064.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.663] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.663] GetFileType (hFile=0x2d0) returned 0x1 [0064.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.663] GetFileType (hFile=0x2d0) returned 0x1 [0064.663] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x8f66 [0064.663] ReadFile (in: hFile=0x2d0, lpBuffer=0x278d06c, nNumberOfBytesToRead=0x8f66, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x278d06c*, lpNumberOfBytesRead=0x8fe7e4*=0x8f66, lpOverlapped=0x0) returned 1 [0064.665] CloseHandle (hObject=0x2d0) returned 1 [0064.681] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", lpFilePart=0x0) returned 0x28 [0064.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.682] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.682] GetFileType (hFile=0x2d0) returned 0x1 [0064.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.682] GetFileType (hFile=0x2d0) returned 0x1 [0064.682] WriteFile (in: hFile=0x2d0, lpBuffer=0x2806ba0*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2806ba0*, lpNumberOfBytesWritten=0x8fe7d4*=0x8f70, lpOverlapped=0x0) returned 1 [0064.687] CloseHandle (hObject=0x2d0) returned 1 [0064.688] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Setup.ico", lpFilePart=0x0) returned 0x28 [0064.688] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x53 [0064.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.688] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x829b9a52, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8f70)) returned 1 [0064.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.688] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.689] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\stop.ico", lpFilePart=0x0) returned 0x27 [0064.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.689] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.689] GetFileType (hFile=0x2d0) returned 0x1 [0064.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.689] GetFileType (hFile=0x2d0) returned 0x1 [0064.689] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x2796 [0064.689] ReadFile (in: hFile=0x2d0, lpBuffer=0x280fef0, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x280fef0*, lpNumberOfBytesRead=0x8fe7e4*=0x2796, lpOverlapped=0x0) returned 1 [0064.691] CloseHandle (hObject=0x2d0) returned 1 [0064.706] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\stop.ico", lpFilePart=0x0) returned 0x27 [0064.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.707] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.707] GetFileType (hFile=0x2d0) returned 0x1 [0064.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.707] GetFileType (hFile=0x2d0) returned 0x1 [0064.707] WriteFile (in: hFile=0x2d0, lpBuffer=0x2869314*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2869314*, lpNumberOfBytesWritten=0x8fe7d4*=0x27a0, lpOverlapped=0x0) returned 1 [0064.708] CloseHandle (hObject=0x2d0) returned 1 [0064.740] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\stop.ico", lpFilePart=0x0) returned 0x27 [0064.740] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x52 [0064.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.741] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x82a523e9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x27a0)) returned 1 [0064.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.741] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.743] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", lpFilePart=0x0) returned 0x2c [0064.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.743] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.743] GetFileType (hFile=0x2d0) returned 0x1 [0064.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.743] GetFileType (hFile=0x2d0) returned 0x1 [0064.743] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x47e [0064.743] ReadFile (in: hFile=0x2d0, lpBuffer=0x286c32c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x286c32c*, lpNumberOfBytesRead=0x8fe7e4*=0x47e, lpOverlapped=0x0) returned 1 [0064.744] CloseHandle (hObject=0x2d0) returned 1 [0064.760] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", lpFilePart=0x0) returned 0x2c [0064.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.760] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.760] GetFileType (hFile=0x2d0) returned 0x1 [0064.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.760] GetFileType (hFile=0x2d0) returned 0x1 [0064.760] WriteFile (in: hFile=0x2d0, lpBuffer=0x28bb8a8*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x28bb8a8*, lpNumberOfBytesWritten=0x8fe7a8*=0x480, lpOverlapped=0x0) returned 1 [0064.761] CloseHandle (hObject=0x2d0) returned 1 [0064.762] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", lpFilePart=0x0) returned 0x2c [0064.762] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0064.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.762] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x82a785f3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x480)) returned 1 [0064.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.762] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.763] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", lpFilePart=0x0) returned 0x2f [0064.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.763] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.763] GetFileType (hFile=0x2d0) returned 0x1 [0064.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.763] GetFileType (hFile=0x2d0) returned 0x1 [0064.763] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x47e [0064.763] ReadFile (in: hFile=0x2d0, lpBuffer=0x28bd070, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x28bd070*, lpNumberOfBytesRead=0x8fe7e4*=0x47e, lpOverlapped=0x0) returned 1 [0064.764] CloseHandle (hObject=0x2d0) returned 1 [0064.780] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", lpFilePart=0x0) returned 0x2f [0064.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.781] GetFileType (hFile=0x2d0) returned 0x1 [0064.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.781] GetFileType (hFile=0x2d0) returned 0x1 [0064.781] WriteFile (in: hFile=0x2d0, lpBuffer=0x290c5f8*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x8fe7a8, lpOverlapped=0x0 | out: lpBuffer=0x290c5f8*, lpNumberOfBytesWritten=0x8fe7a8*=0x480, lpOverlapped=0x0) returned 1 [0064.781] CloseHandle (hObject=0x2d0) returned 1 [0064.782] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", lpFilePart=0x0) returned 0x2f [0064.782] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5a [0064.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.782] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x82a9e8bf, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x480)) returned 1 [0064.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.782] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.783] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\warn.ico", lpFilePart=0x0) returned 0x27 [0064.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0064.783] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.783] GetFileType (hFile=0x2d0) returned 0x1 [0064.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0064.783] GetFileType (hFile=0x2d0) returned 0x1 [0064.783] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0x2796 [0064.783] ReadFile (in: hFile=0x2d0, lpBuffer=0x290d928, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x290d928*, lpNumberOfBytesRead=0x8fe7e4*=0x2796, lpOverlapped=0x0) returned 1 [0064.819] CloseHandle (hObject=0x2d0) returned 1 [0064.837] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\warn.ico", lpFilePart=0x0) returned 0x27 [0064.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0064.837] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0064.838] GetFileType (hFile=0x2d0) returned 0x1 [0064.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0064.838] GetFileType (hFile=0x2d0) returned 0x1 [0064.838] WriteFile (in: hFile=0x2d0, lpBuffer=0x2769138*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x2769138*, lpNumberOfBytesWritten=0x8fe7d4*=0x27a0, lpOverlapped=0x0) returned 1 [0064.840] CloseHandle (hObject=0x2d0) returned 1 [0064.841] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\warn.ico", lpFilePart=0x0) returned 0x27 [0064.841] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x52 [0064.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0064.841] GetFileAttributesExW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x82b37222, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x27a0)) returned 1 [0064.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.841] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0064.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0064.842] GetFullPathNameW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\588bce7c90097ed212\\Graphics", lpFilePart=0x0) returned 0x1e [0064.842] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x82b37222, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x82b37222, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb25208 [0064.842] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x82b37222, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x82b37222, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.842] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x8257f9b4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="PRINTI~1.MAD")) returned 1 [0064.842] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x8263e9a7, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ROTATE~1.MAD")) returned 1 [0064.843] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x8268ad8f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ROTATE~2.MAD")) returned 1 [0064.843] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x826e4aef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ROTATE~3.MAD")) returned 1 [0064.843] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x827574b2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ROTATE~4.MAD")) returned 1 [0064.843] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x827a3908, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="RO9E63~1.MAD")) returned 1 [0064.843] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x8283c3a3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="RO1B45~1.MAD")) returned 1 [0064.843] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x828624ea, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="RO78D8~1.MAD")) returned 1 [0064.843] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x828fb018, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="RODC30~1.MAD")) returned 1 [0064.843] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x82993810, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="SAVEIC~1.MAD")) returned 1 [0064.843] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x829b9a52, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="SETUPI~1.MAD")) returned 1 [0064.843] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x82a523e9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x27a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="STOPIC~1.MAD")) returned 1 [0064.844] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x82a785f3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="SYSREQ~1.MAD")) returned 1 [0064.844] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x82a9e8bf, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="SYSREQ~2.MAD")) returned 1 [0064.844] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x82b37222, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x27a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="WARNIC~1.MAD")) returned 1 [0064.844] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x82b37222, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x27a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="WARNIC~1.MAD")) returned 0 [0064.844] FindClose (in: hFindFile=0xb25208 | out: hFindFile=0xb25208) returned 1 [0064.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0064.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0064.844] GetFullPathNameW (in: lpFileName="C:\\ESD", nBufferLength=0x105, lpBuffer=0x8fe360, lpFilePart=0x0 | out: lpBuffer="C:\\ESD", lpFilePart=0x0) returned 0x6 [0064.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe878) returned 1 [0064.844] GetFullPathNameW (in: lpFileName="C:\\ESD", nBufferLength=0x105, lpBuffer=0x8fe32c, lpFilePart=0x0 | out: lpBuffer="C:\\ESD", lpFilePart=0x0) returned 0x6 [0064.844] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x8fe5a0 | out: lpFindFileData=0x8fe5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb25208 [0064.848] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.848] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.848] FindClose (in: hFindFile=0xb25208 | out: hFindFile=0xb25208) returned 1 [0064.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe834) returned 1 [0064.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe840) returned 1 [0064.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe878) returned 1 [0064.849] GetFullPathNameW (in: lpFileName="C:\\ESD", nBufferLength=0x105, lpBuffer=0x8fe32c, lpFilePart=0x0 | out: lpBuffer="C:\\ESD", lpFilePart=0x0) returned 0x6 [0064.849] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x8fe5a0 | out: lpFindFileData=0x8fe5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb24d88 [0064.849] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.849] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.849] FindClose (in: hFindFile=0xb24d88 | out: hFindFile=0xb24d88) returned 1 [0064.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe834) returned 1 [0064.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe840) returned 1 [0064.849] GetFullPathNameW (in: lpFileName="C:\\Logs", nBufferLength=0x105, lpBuffer=0x8fe360, lpFilePart=0x0 | out: lpBuffer="C:\\Logs", lpFilePart=0x0) returned 0x7 [0064.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe878) returned 1 [0064.849] GetFullPathNameW (in: lpFileName="C:\\Logs", nBufferLength=0x105, lpBuffer=0x8fe32c, lpFilePart=0x0 | out: lpBuffer="C:\\Logs", lpFilePart=0x0) returned 0x7 [0064.849] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x8fe5a0 | out: lpFindFileData=0x8fe5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb24e08 [0064.853] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.882] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0064.882] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0064.882] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0064.882] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0064.882] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0064.882] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0064.883] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0064.883] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0064.883] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0064.883] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0064.883] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0064.883] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0064.883] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0064.883] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0064.883] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0064.883] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0064.883] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0064.884] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0064.884] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0064.884] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0064.884] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0064.884] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0064.884] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0064.884] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0064.885] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0064.885] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0064.885] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0064.885] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0064.885] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0064.885] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0064.885] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0064.885] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0064.885] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0064.885] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0064.885] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0064.885] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0064.886] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0064.886] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0064.886] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0064.886] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0064.886] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0064.886] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0064.886] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0064.887] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0064.887] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0064.887] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0064.887] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0064.887] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0064.887] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0064.887] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0064.887] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0064.887] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0064.887] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0064.887] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0064.887] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0064.888] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0064.888] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0064.888] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0064.888] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0064.888] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0064.888] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0064.888] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0064.889] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0064.889] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0064.889] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0064.889] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0064.889] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0064.889] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0064.889] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0064.889] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0064.889] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0064.889] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0064.890] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0064.890] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0064.890] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0064.890] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0064.890] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0064.890] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0064.890] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0064.890] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0064.890] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0064.890] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0064.891] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0064.891] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0064.891] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0064.891] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0064.891] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0064.891] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0064.891] FindNextFileW (in: hFindFile=0xb24e08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.891] FindClose (in: hFindFile=0xb24e08 | out: hFindFile=0xb24e08) returned 1 [0064.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe834) returned 1 [0064.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe840) returned 1 [0064.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe878) returned 1 [0064.892] GetFullPathNameW (in: lpFileName="C:\\Logs", nBufferLength=0x105, lpBuffer=0x8fe32c, lpFilePart=0x0 | out: lpBuffer="C:\\Logs", lpFilePart=0x0) returned 0x7 [0064.892] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x8fe5a0 | out: lpFindFileData=0x8fe5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb25208 [0064.893] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.893] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0064.894] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0064.894] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0064.894] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0064.894] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0064.894] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0064.894] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0064.894] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0064.894] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0064.894] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0064.894] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0064.895] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0064.895] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0064.895] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0064.895] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0064.895] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0064.895] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0064.895] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0064.895] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0064.895] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0064.895] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0064.896] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0064.896] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0064.896] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0064.896] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0064.896] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0064.896] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0064.896] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0064.896] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0064.896] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0064.896] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0064.896] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0064.896] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0064.897] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0064.897] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0064.897] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0064.897] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0064.897] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0064.897] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0064.897] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0064.897] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0064.897] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0064.897] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0064.898] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0064.899] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0064.899] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0064.899] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0064.899] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0064.899] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0064.899] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0064.899] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0064.899] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0064.899] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0064.900] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0064.901] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0064.901] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0064.901] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0064.901] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0064.901] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0064.901] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0064.901] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0064.901] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0064.901] FindClose (in: hFindFile=0xb25208 | out: hFindFile=0xb25208) returned 1 [0064.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe834) returned 1 [0064.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe840) returned 1 [0064.902] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x8fe360, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0064.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe878) returned 1 [0064.902] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x8fe32c, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0064.902] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x8fe5a0 | out: lpFindFileData=0x8fe5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb25188 [0064.904] FindNextFileW (in: hFindFile=0xb25188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.904] FindNextFileW (in: hFindFile=0xb25188, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.904] FindClose (in: hFindFile=0xb25188 | out: hFindFile=0xb25188) returned 1 [0064.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe834) returned 1 [0064.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe840) returned 1 [0064.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe878) returned 1 [0064.904] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x8fe32c, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0064.904] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x8fe5a0 | out: lpFindFileData=0x8fe5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb24d08 [0064.904] FindNextFileW (in: hFindFile=0xb24d08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.904] FindNextFileW (in: hFindFile=0xb24d08, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.904] FindClose (in: hFindFile=0xb24d08 | out: hFindFile=0xb24d08) returned 1 [0064.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe834) returned 1 [0064.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe840) returned 1 [0064.904] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x8fe360, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0064.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe878) returned 1 [0064.905] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x8fe32c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0064.905] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x8fe5a0 | out: lpFindFileData=0x8fe5a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb24d88 [0064.905] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.905] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0064.905] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0064.905] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0064.905] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0064.905] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0064.905] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0064.905] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0064.905] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0064.905] FindClose (in: hFindFile=0xb24d88 | out: hFindFile=0xb24d88) returned 1 [0064.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe834) returned 1 [0064.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe840) returned 1 [0064.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe878) returned 1 [0064.905] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x8fe32c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0064.905] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x8fe5a0 | out: lpFindFileData=0x8fe5a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb25348 [0064.905] FindNextFileW (in: hFindFile=0xb25348, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.905] FindNextFileW (in: hFindFile=0xb25348, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0064.906] FindNextFileW (in: hFindFile=0xb25348, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0064.906] FindNextFileW (in: hFindFile=0xb25348, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0064.906] FindNextFileW (in: hFindFile=0xb25348, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0064.906] FindNextFileW (in: hFindFile=0xb25348, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0064.906] FindNextFileW (in: hFindFile=0xb25348, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0064.906] FindNextFileW (in: hFindFile=0xb25348, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0064.906] FindNextFileW (in: hFindFile=0xb25348, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.906] FindClose (in: hFindFile=0xb25348 | out: hFindFile=0xb25348) returned 1 [0064.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe834) returned 1 [0064.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe840) returned 1 [0064.906] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated", lpFilePart=0x0) returned 0x19 [0064.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0064.906] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated", lpFilePart=0x0) returned 0x19 [0064.906] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb25208 [0064.909] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.909] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0064.909] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0064.909] FindNextFileW (in: hFindFile=0xb25208, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0064.909] FindClose (in: hFindFile=0xb25208 | out: hFindFile=0xb25208) returned 1 [0064.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0064.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0064.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0064.910] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated", lpFilePart=0x0) returned 0x19 [0064.910] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb25408 [0064.910] FindNextFileW (in: hFindFile=0xb25408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.910] FindNextFileW (in: hFindFile=0xb25408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0064.910] FindNextFileW (in: hFindFile=0xb25408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0064.911] FindNextFileW (in: hFindFile=0xb25408, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.911] FindClose (in: hFindFile=0xb25408 | out: hFindFile=0xb25408) returned 1 [0064.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0064.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0064.911] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData", lpFilePart=0x0) returned 0x21 [0064.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0064.911] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData", lpFilePart=0x0) returned 0x21 [0064.911] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb24d88 [0064.914] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.914] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0064.914] FindNextFileW (in: hFindFile=0xb24d88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0064.914] FindClose (in: hFindFile=0xb24d88 | out: hFindFile=0xb24d88) returned 1 [0064.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0064.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0064.914] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData", lpFilePart=0x0) returned 0x21 [0064.914] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb24dc8 [0064.914] FindNextFileW (in: hFindFile=0xb24dc8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.914] FindNextFileW (in: hFindFile=0xb24dc8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0064.914] FindNextFileW (in: hFindFile=0xb24dc8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.914] FindClose (in: hFindFile=0xb24dc8 | out: hFindFile=0xb24dc8) returned 1 [0064.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0064.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.914] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Local", lpFilePart=0x0) returned 0x27 [0064.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0064.915] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Local", lpFilePart=0x0) returned 0x27 [0064.915] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb24e48 [0064.915] FindNextFileW (in: hFindFile=0xb24e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.915] FindNextFileW (in: hFindFile=0xb24e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0064.915] FindNextFileW (in: hFindFile=0xb24e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0064.915] FindClose (in: hFindFile=0xb24e48 | out: hFindFile=0xb24e48) returned 1 [0064.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0064.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0064.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0064.915] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Local", lpFilePart=0x0) returned 0x27 [0064.915] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb25088 [0064.915] FindNextFileW (in: hFindFile=0xb25088, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.915] FindNextFileW (in: hFindFile=0xb25088, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0064.915] FindNextFileW (in: hFindFile=0xb25088, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.915] FindClose (in: hFindFile=0xb25088 | out: hFindFile=0xb25088) returned 1 [0064.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0064.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0064.916] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x8fe250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x31 [0064.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0064.916] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x31 [0064.916] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb25148 [0064.916] FindNextFileW (in: hFindFile=0xb25148, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.916] FindNextFileW (in: hFindFile=0xb25148, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0064.916] FindNextFileW (in: hFindFile=0xb25148, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0064.916] FindClose (in: hFindFile=0xb25148 | out: hFindFile=0xb25148) returned 1 [0064.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0064.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0064.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0064.916] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x31 [0064.916] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb24f88 [0064.916] FindNextFileW (in: hFindFile=0xb24f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.916] FindNextFileW (in: hFindFile=0xb24f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0064.916] FindNextFileW (in: hFindFile=0xb24f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.916] FindClose (in: hFindFile=0xb24f88 | out: hFindFile=0xb24f88) returned 1 [0064.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0064.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0064.917] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents", lpFilePart=0x0) returned 0x23 [0064.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0064.917] GetFullPathNameW (in: lpFileName="C:\\Users\\Default.migrated\\Documents", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default.migrated\\Documents", lpFilePart=0x0) returned 0x23 [0064.917] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xb24e08 [0064.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0064.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0064.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0064.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0064.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0064.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0064.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0064.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0064.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0064.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0064.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0064.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0064.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0064.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0064.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0064.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0064.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0064.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0064.964] ReadFile (in: hFile=0x2d0, lpBuffer=0x279a54c, nNumberOfBytesToRead=0x13894, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x279a54c*, lpNumberOfBytesRead=0x8fe7a0*=0x13894, lpOverlapped=0x0) returned 1 [0064.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0065.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0065.037] WriteFile (in: hFile=0x2d0, lpBuffer=0x2821e9c*, nNumberOfBytesToWrite=0x138a0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2821e9c*, lpNumberOfBytesWritten=0x8fe790*=0x138a0, lpOverlapped=0x0) returned 1 [0065.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0065.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0065.084] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\2MfNLy9YL.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\2mfnly9yl.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\2MfNLy9YL.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\2mfnly9yl.jpg.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0065.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0065.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0065.321] ReadFile (in: hFile=0x2d0, lpBuffer=0x2835b48, nNumberOfBytesToRead=0x9cc0, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2835b48*, lpNumberOfBytesRead=0x8fe7a0*=0x9cc0, lpOverlapped=0x0) returned 1 [0065.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0065.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0065.381] WriteFile (in: hFile=0x2d0, lpBuffer=0x28b3958*, nNumberOfBytesToWrite=0x9cd0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x28b3958*, lpNumberOfBytesWritten=0x8fe790*=0x9cd0, lpOverlapped=0x0) returned 1 [0065.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0065.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0065.428] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\4Vx1iEbtfzj_6u_p.png" (normalized: "c:\\users\\fd1hvy\\desktop\\4vx1iebtfzj_6u_p.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\4Vx1iEbtfzj_6u_p.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\4vx1iebtfzj_6u_p.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0065.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0065.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0065.497] ReadFile (in: hFile=0x2d0, lpBuffer=0x28be4b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28be4b4*, lpNumberOfBytesRead=0x8fe7a0*=0xa72, lpOverlapped=0x0) returned 1 [0065.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0065.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0065.586] WriteFile (in: hFile=0x2d0, lpBuffer=0x290f81c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x290f81c*, lpNumberOfBytesWritten=0x8fe764*=0xa80, lpOverlapped=0x0) returned 1 [0065.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0065.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0065.631] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\5SL d.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\5sl d.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\5SL d.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\5sl d.mp4.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0065.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0065.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0065.679] ReadFile (in: hFile=0x2d0, lpBuffer=0x2910b3c, nNumberOfBytesToRead=0x134e, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2910b3c*, lpNumberOfBytesRead=0x8fe7a0*=0x134e, lpOverlapped=0x0) returned 1 [0065.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0065.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0065.739] WriteFile (in: hFile=0x2d0, lpBuffer=0x2764cc4*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2764cc4*, lpNumberOfBytesWritten=0x8fe790*=0x1350, lpOverlapped=0x0) returned 1 [0065.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0065.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0065.741] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\7V-eIqickbho8mYRnU.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\7v-eiqickbho8myrnu.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\7V-eIqickbho8mYRnU.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\7v-eiqickbho8myrnu.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0065.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0065.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0065.773] ReadFile (in: hFile=0x2d0, lpBuffer=0x276646c, nNumberOfBytesToRead=0x10186, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x276646c*, lpNumberOfBytesRead=0x8fe7a0*=0x10186, lpOverlapped=0x0) returned 1 [0065.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0065.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0065.881] WriteFile (in: hFile=0x2d0, lpBuffer=0x27e3890*, nNumberOfBytesToWrite=0x10190, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27e3890*, lpNumberOfBytesWritten=0x8fe790*=0x10190, lpOverlapped=0x0) returned 1 [0065.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0065.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0065.916] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\7XVRurzJMiaIbWrBm-.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\7xvrurzjmiaibwrbm-.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\7XVRurzJMiaIbWrBm-.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\7xvrurzjmiaibwrbm-.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0065.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0065.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0065.961] ReadFile (in: hFile=0x2d0, lpBuffer=0x27f4a74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27f4a74*, lpNumberOfBytesRead=0x8fe7a0*=0xc10, lpOverlapped=0x0) returned 1 [0065.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.031] WriteFile (in: hFile=0x2d0, lpBuffer=0x2846614*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x2846614*, lpNumberOfBytesWritten=0x8fe764*=0xc20, lpOverlapped=0x0) returned 1 [0066.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.032] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Cc4lI_NT2LJ.png" (normalized: "c:\\users\\fd1hvy\\desktop\\cc4li_nt2lj.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Cc4lI_NT2LJ.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\cc4li_nt2lj.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.034] ReadFile (in: hFile=0x2d0, lpBuffer=0x2847930, nNumberOfBytesToRead=0x4d30, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2847930*, lpNumberOfBytesRead=0x8fe7a0*=0x4d30, lpOverlapped=0x0) returned 1 [0066.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.051] WriteFile (in: hFile=0x2d0, lpBuffer=0x28ac970*, nNumberOfBytesToWrite=0x4d40, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x28ac970*, lpNumberOfBytesWritten=0x8fe790*=0x4d40, lpOverlapped=0x0) returned 1 [0066.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.075] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\D04_R-n2DnPnWv3.png" (normalized: "c:\\users\\fd1hvy\\desktop\\d04_r-n2dnpnwv3.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\D04_R-n2DnPnWv3.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\d04_r-n2dnpnwv3.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.077] ReadFile (in: hFile=0x2d0, lpBuffer=0x39be068, nNumberOfBytesToRead=0x17cb0, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x39be068*, lpNumberOfBytesRead=0x8fe7a0*=0x17cb0, lpOverlapped=0x0) returned 1 [0066.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.188] WriteFile (in: hFile=0x2d0, lpBuffer=0x3728c08*, nNumberOfBytesToWrite=0x17cc0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x3728c08*, lpNumberOfBytesWritten=0x8fe790*=0x17cc0, lpOverlapped=0x0) returned 1 [0066.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.190] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\dQMrXkBPPmhselSrEbWM.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\dqmrxkbppmhselsrebwm.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\dQMrXkBPPmhselSrEbWM.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\dqmrxkbppmhselsrebwm.mp4.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.199] ReadFile (in: hFile=0x2d0, lpBuffer=0x26ee594, nNumberOfBytesToRead=0xabbc, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x26ee594*, lpNumberOfBytesRead=0x8fe7a0*=0xabbc, lpOverlapped=0x0) returned 1 [0066.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.257] WriteFile (in: hFile=0x2d0, lpBuffer=0x275b844*, nNumberOfBytesToWrite=0xabc0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x275b844*, lpNumberOfBytesWritten=0x8fe790*=0xabc0, lpOverlapped=0x0) returned 1 [0066.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.260] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\EcydCaDQpYezzL1k6Pm.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\ecydcadqpyezzl1k6pm.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\EcydCaDQpYezzL1k6Pm.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\ecydcadqpyezzl1k6pm.avi.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.264] ReadFile (in: hFile=0x2d0, lpBuffer=0x276684c, nNumberOfBytesToRead=0x3091, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x276684c*, lpNumberOfBytesRead=0x8fe7a0*=0x3091, lpOverlapped=0x0) returned 1 [0066.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.280] WriteFile (in: hFile=0x2d0, lpBuffer=0x27c2970*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27c2970*, lpNumberOfBytesWritten=0x8fe790*=0x30a0, lpOverlapped=0x0) returned 1 [0066.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.281] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ENUiDg4yY9kQ.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\enuidg4yy9kq.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ENUiDg4yY9kQ.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\enuidg4yy9kq.mp3.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.283] ReadFile (in: hFile=0x2d0, lpBuffer=0x27c5e2c, nNumberOfBytesToRead=0x7ab5, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27c5e2c*, lpNumberOfBytesRead=0x8fe7a0*=0x7ab5, lpOverlapped=0x0) returned 1 [0066.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.347] WriteFile (in: hFile=0x2d0, lpBuffer=0x28391f0*, nNumberOfBytesToWrite=0x7ac0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x28391f0*, lpNumberOfBytesWritten=0x8fe790*=0x7ac0, lpOverlapped=0x0) returned 1 [0066.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.348] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\EsKgrHK14NuBXlkOEy.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\eskgrhk14nubxlkoey.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\EsKgrHK14NuBXlkOEy.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\eskgrhk14nubxlkoey.gif.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.350] ReadFile (in: hFile=0x2d0, lpBuffer=0x28410f0, nNumberOfBytesToRead=0x84b8, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28410f0*, lpNumberOfBytesRead=0x8fe7a0*=0x84b8, lpOverlapped=0x0) returned 1 [0066.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.367] WriteFile (in: hFile=0x2d0, lpBuffer=0x28b76b0*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x28b76b0*, lpNumberOfBytesWritten=0x8fe790*=0x84c0, lpOverlapped=0x0) returned 1 [0066.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.369] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\eW4ttRempuil.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\ew4ttrempuil.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\eW4ttRempuil.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\ew4ttrempuil.flv.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.371] ReadFile (in: hFile=0x2d0, lpBuffer=0x3756068, nNumberOfBytesToRead=0x1595c, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x3756068*, lpNumberOfBytesRead=0x8fe7a0*=0x1595c, lpOverlapped=0x0) returned 1 [0066.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.441] WriteFile (in: hFile=0x2d0, lpBuffer=0x37c1f80*, nNumberOfBytesToWrite=0x15960, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x37c1f80*, lpNumberOfBytesWritten=0x8fe790*=0x15960, lpOverlapped=0x0) returned 1 [0066.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.443] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Eztoh.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\eztoh.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Eztoh.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\eztoh.swf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.445] ReadFile (in: hFile=0x2d0, lpBuffer=0x270d4bc, nNumberOfBytesToRead=0xa564, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x270d4bc*, lpNumberOfBytesRead=0x8fe7a0*=0xa564, lpOverlapped=0x0) returned 1 [0066.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.463] WriteFile (in: hFile=0x2d0, lpBuffer=0x278df48*, nNumberOfBytesToWrite=0xa570, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x278df48*, lpNumberOfBytesWritten=0x8fe790*=0xa570, lpOverlapped=0x0) returned 1 [0066.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.464] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\fpWjfsK _rcQW_dA.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\fpwjfsk _rcqw_da.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\fpWjfsK _rcQW_dA.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\fpwjfsk _rcqw_da.mp3.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.466] ReadFile (in: hFile=0x2d0, lpBuffer=0x27988fc, nNumberOfBytesToRead=0x13645, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27988fc*, lpNumberOfBytesRead=0x8fe7a0*=0x13645, lpOverlapped=0x0) returned 1 [0066.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.628] WriteFile (in: hFile=0x2d0, lpBuffer=0x281fa04*, nNumberOfBytesToWrite=0x13650, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x281fa04*, lpNumberOfBytesWritten=0x8fe790*=0x13650, lpOverlapped=0x0) returned 1 [0066.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.630] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\gmAISQA1IkJR5JvZJa.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\gmaisqa1ikjr5jvzja.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\gmAISQA1IkJR5JvZJa.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\gmaisqa1ikjr5jvzja.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.633] ReadFile (in: hFile=0x2d0, lpBuffer=0x2833d1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2833d1c*, lpNumberOfBytesRead=0x8fe7a0*=0x88a, lpOverlapped=0x0) returned 1 [0066.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.648] WriteFile (in: hFile=0x2d0, lpBuffer=0x28846dc*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x28846dc*, lpNumberOfBytesWritten=0x8fe764*=0x890, lpOverlapped=0x0) returned 1 [0066.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.649] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GmWsVfMPD.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\gmwsvfmpd.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\GmWsVfMPD.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\gmwsvfmpd.mp3.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.651] ReadFile (in: hFile=0x2d0, lpBuffer=0x2885a04, nNumberOfBytesToRead=0x13324, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2885a04*, lpNumberOfBytesRead=0x8fe7a0*=0x13324, lpOverlapped=0x0) returned 1 [0066.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.765] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Hj KDy0x-tdXgfIqynMQ.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\hj kdy0x-tdxgfiqynmq.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0066.766] GetFileType (hFile=0x2d0) returned 0x1 [0066.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.766] GetFileType (hFile=0x2d0) returned 0x1 [0066.766] WriteFile (in: hFile=0x2d0, lpBuffer=0x27283d4*, nNumberOfBytesToWrite=0x13330, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27283d4*, lpNumberOfBytesWritten=0x8fe790*=0x13330, lpOverlapped=0x0) returned 1 [0066.768] CloseHandle (hObject=0x2d0) returned 1 [0066.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Hj KDy0x-tdXgfIqynMQ.odp", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Hj KDy0x-tdXgfIqynMQ.odp", lpFilePart=0x0) returned 0x30 [0066.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Hj KDy0x-tdXgfIqynMQ.odp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Hj KDy0x-tdXgfIqynMQ.odp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5b [0066.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.770] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Hj KDy0x-tdXgfIqynMQ.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\hj kdy0x-tdxgfiqynmq.odp"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ae02f0, ftCreationTime.dwHighDateTime=0x1d630cc, ftLastAccessTime.dwLowDateTime=0xe7cfa3a0, ftLastAccessTime.dwHighDateTime=0x1d624df, ftLastWriteTime.dwLowDateTime=0x83d88a5c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13330)) returned 1 [0066.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.770] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Hj KDy0x-tdXgfIqynMQ.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\hj kdy0x-tdxgfiqynmq.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Hj KDy0x-tdXgfIqynMQ.odp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\hj kdy0x-tdxgfiqynmq.odp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg", lpFilePart=0x0) returned 0x2d [0066.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.771] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\io3yk vnzcjw4gga6.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0066.771] GetFileType (hFile=0x2d0) returned 0x1 [0066.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.771] GetFileType (hFile=0x2d0) returned 0x1 [0066.771] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x16d30 [0066.771] ReadFile (in: hFile=0x2d0, lpBuffer=0x3824c00, nNumberOfBytesToRead=0x16d30, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x3824c00*, lpNumberOfBytesRead=0x8fe7a0*=0x16d30, lpOverlapped=0x0) returned 1 [0066.772] CloseHandle (hObject=0x2d0) returned 1 [0066.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg", lpFilePart=0x0) returned 0x2d [0066.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\io3yk vnzcjw4gga6.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0066.796] GetFileType (hFile=0x2d0) returned 0x1 [0066.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.796] GetFileType (hFile=0x2d0) returned 0x1 [0066.796] WriteFile (in: hFile=0x2d0, lpBuffer=0x3896e70*, nNumberOfBytesToWrite=0x16d40, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x3896e70*, lpNumberOfBytesWritten=0x8fe790*=0x16d40, lpOverlapped=0x0) returned 1 [0066.798] CloseHandle (hObject=0x2d0) returned 1 [0066.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg", lpFilePart=0x0) returned 0x2d [0066.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x58 [0066.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\io3yk vnzcjw4gga6.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f9c3bf0, ftCreationTime.dwHighDateTime=0x1d62930, ftLastAccessTime.dwLowDateTime=0x388f9f80, ftLastAccessTime.dwHighDateTime=0x1d62c0a, ftLastWriteTime.dwLowDateTime=0x83dd50a7, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16d40)) returned 1 [0066.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.800] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\io3yk vnzcjw4gga6.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\iO3YK VNzCJw4gGA6.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\io3yk vnzcjw4gga6.jpg.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.801] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp", lpFilePart=0x0) returned 0x30 [0066.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.801] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\kgt-pujyzfu_hcwpqwdq.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0066.801] GetFileType (hFile=0x2d0) returned 0x1 [0066.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.801] GetFileType (hFile=0x2d0) returned 0x1 [0066.801] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x117f7 [0066.801] ReadFile (in: hFile=0x2d0, lpBuffer=0x2788f2c, nNumberOfBytesToRead=0x117f7, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2788f2c*, lpNumberOfBytesRead=0x8fe7a0*=0x117f7, lpOverlapped=0x0) returned 1 [0066.895] CloseHandle (hObject=0x2d0) returned 1 [0066.913] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp", lpFilePart=0x0) returned 0x30 [0066.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.913] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\kgt-pujyzfu_hcwpqwdq.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0066.914] GetFileType (hFile=0x2d0) returned 0x1 [0066.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.914] GetFileType (hFile=0x2d0) returned 0x1 [0066.914] WriteFile (in: hFile=0x2d0, lpBuffer=0x280a544*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x280a544*, lpNumberOfBytesWritten=0x8fe790*=0x11800, lpOverlapped=0x0) returned 1 [0066.915] CloseHandle (hObject=0x2d0) returned 1 [0066.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp", lpFilePart=0x0) returned 0x30 [0066.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5b [0066.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0066.917] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\kgt-pujyzfu_hcwpqwdq.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cdc2c0, ftCreationTime.dwHighDateTime=0x1d62e91, ftLastAccessTime.dwLowDateTime=0x81c95980, ftLastAccessTime.dwHighDateTime=0x1d62a38, ftLastWriteTime.dwLowDateTime=0x83f06142, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11800)) returned 1 [0066.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0066.917] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\kgt-pujyzfu_hcwpqwdq.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\KGT-PUjYzfU_HcwPQWdQ.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\kgt-pujyzfu_hcwpqwdq.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0066.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png", lpFilePart=0x0) returned 0x2e [0066.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0066.918] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png" (normalized: "c:\\users\\fd1hvy\\desktop\\kqxvotdjb4_49_ps4p.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0066.918] GetFileType (hFile=0x2d0) returned 0x1 [0066.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0066.918] GetFileType (hFile=0x2d0) returned 0x1 [0066.918] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x18456 [0066.918] ReadFile (in: hFile=0x2d0, lpBuffer=0x38d0bd0, nNumberOfBytesToRead=0x18456, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x38d0bd0*, lpNumberOfBytesRead=0x8fe7a0*=0x18456, lpOverlapped=0x0) returned 1 [0066.919] CloseHandle (hObject=0x2d0) returned 1 [0066.940] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png", lpFilePart=0x0) returned 0x2e [0066.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0066.940] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png" (normalized: "c:\\users\\fd1hvy\\desktop\\kqxvotdjb4_49_ps4p.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0066.941] GetFileType (hFile=0x2d0) returned 0x1 [0066.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0066.941] GetFileType (hFile=0x2d0) returned 0x1 [0066.941] WriteFile (in: hFile=0x2d0, lpBuffer=0x394a1e8*, nNumberOfBytesToWrite=0x18460, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x394a1e8*, lpNumberOfBytesWritten=0x8fe790*=0x18460, lpOverlapped=0x0) returned 1 [0067.037] CloseHandle (hObject=0x2d0) returned 1 [0067.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png", lpFilePart=0x0) returned 0x2e [0067.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x59 [0067.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0067.040] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png" (normalized: "c:\\users\\fd1hvy\\desktop\\kqxvotdjb4_49_ps4p.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x571d5230, ftCreationTime.dwHighDateTime=0x1d62502, ftLastAccessTime.dwLowDateTime=0x8166c020, ftLastAccessTime.dwHighDateTime=0x1d625a3, ftLastWriteTime.dwLowDateTime=0x84037593, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x18460)) returned 1 [0067.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0067.040] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png" (normalized: "c:\\users\\fd1hvy\\desktop\\kqxvotdjb4_49_ps4p.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\KqxvOTDjB4_49_PS4p.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\kqxvotdjb4_49_ps4p.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0067.041] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi", lpFilePart=0x0) returned 0x27 [0067.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0067.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\lo1l_wbbps5.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.041] GetFileType (hFile=0x2d0) returned 0x1 [0067.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0067.041] GetFileType (hFile=0x2d0) returned 0x1 [0067.041] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x11c7 [0067.041] ReadFile (in: hFile=0x2d0, lpBuffer=0x28693f8, nNumberOfBytesToRead=0x11c7, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28693f8*, lpNumberOfBytesRead=0x8fe7a0*=0x11c7, lpOverlapped=0x0) returned 1 [0067.041] CloseHandle (hObject=0x2d0) returned 1 [0067.061] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi", lpFilePart=0x0) returned 0x27 [0067.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0067.061] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\lo1l_wbbps5.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.062] GetFileType (hFile=0x2d0) returned 0x1 [0067.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0067.062] GetFileType (hFile=0x2d0) returned 0x1 [0067.062] WriteFile (in: hFile=0x2d0, lpBuffer=0x28bbb0c*, nNumberOfBytesToWrite=0x11d0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x28bbb0c*, lpNumberOfBytesWritten=0x8fe790*=0x11d0, lpOverlapped=0x0) returned 1 [0067.062] CloseHandle (hObject=0x2d0) returned 1 [0067.063] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi", lpFilePart=0x0) returned 0x27 [0067.063] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x52 [0067.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0067.063] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\lo1l_wbbps5.avi"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50870110, ftCreationTime.dwHighDateTime=0x1d623c6, ftLastAccessTime.dwLowDateTime=0xe4ed2510, ftLastAccessTime.dwHighDateTime=0x1d6254b, ftLastWriteTime.dwLowDateTime=0x8405d649, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11d0)) returned 1 [0067.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0067.063] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\lo1l_wbbps5.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Lo1L_wbbpS5.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\lo1l_wbbps5.avi.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0067.064] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf", lpFilePart=0x0) returned 0x28 [0067.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0067.064] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\nsi 1 tylyqv.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.064] GetFileType (hFile=0x2d0) returned 0x1 [0067.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0067.064] GetFileType (hFile=0x2d0) returned 0x1 [0067.064] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x13243 [0067.064] ReadFile (in: hFile=0x2d0, lpBuffer=0x28bd0ec, nNumberOfBytesToRead=0x13243, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28bd0ec*, lpNumberOfBytesRead=0x8fe7a0*=0x13243, lpOverlapped=0x0) returned 1 [0067.064] CloseHandle (hObject=0x2d0) returned 1 [0067.287] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf", lpFilePart=0x0) returned 0x28 [0067.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0067.287] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\nsi 1 tylyqv.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.288] GetFileType (hFile=0x2d0) returned 0x1 [0067.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0067.288] GetFileType (hFile=0x2d0) returned 0x1 [0067.288] WriteFile (in: hFile=0x2d0, lpBuffer=0x29435f4*, nNumberOfBytesToWrite=0x13250, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x29435f4*, lpNumberOfBytesWritten=0x8fe790*=0x13250, lpOverlapped=0x0) returned 1 [0067.289] CloseHandle (hObject=0x2d0) returned 1 [0067.291] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf", lpFilePart=0x0) returned 0x28 [0067.291] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x53 [0067.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0067.291] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\nsi 1 tylyqv.swf"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde391ff0, ftCreationTime.dwHighDateTime=0x1d62d69, ftLastAccessTime.dwLowDateTime=0x7af2c2a0, ftLastAccessTime.dwHighDateTime=0x1d624ec, ftLastWriteTime.dwLowDateTime=0x84299a44, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13250)) returned 1 [0067.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0067.291] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\nsi 1 tylyqv.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nsi 1 tylYQv.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\nsi 1 tylyqv.swf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0067.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav", lpFilePart=0x0) returned 0x2f [0067.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0067.292] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\ntnv41z8vtwtx5gvsqm.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.292] GetFileType (hFile=0x2d0) returned 0x1 [0067.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0067.292] GetFileType (hFile=0x2d0) returned 0x1 [0067.292] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x130f7 [0067.292] ReadFile (in: hFile=0x2d0, lpBuffer=0x2956c60, nNumberOfBytesToRead=0x130f7, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2956c60*, lpNumberOfBytesRead=0x8fe7a0*=0x130f7, lpOverlapped=0x0) returned 1 [0067.293] CloseHandle (hObject=0x2d0) returned 1 [0067.312] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav", lpFilePart=0x0) returned 0x2f [0067.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0067.312] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\ntnv41z8vtwtx5gvsqm.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.313] GetFileType (hFile=0x2d0) returned 0x1 [0067.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0067.313] GetFileType (hFile=0x2d0) returned 0x1 [0067.313] WriteFile (in: hFile=0x2d0, lpBuffer=0x29dcd78*, nNumberOfBytesToWrite=0x13100, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x29dcd78*, lpNumberOfBytesWritten=0x8fe790*=0x13100, lpOverlapped=0x0) returned 1 [0067.314] CloseHandle (hObject=0x2d0) returned 1 [0067.316] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav", lpFilePart=0x0) returned 0x2f [0067.316] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5a [0067.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0067.316] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\ntnv41z8vtwtx5gvsqm.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1bb8d40, ftCreationTime.dwHighDateTime=0x1d626a9, ftLastAccessTime.dwLowDateTime=0xf32eeab0, ftLastAccessTime.dwHighDateTime=0x1d632a1, ftLastWriteTime.dwLowDateTime=0x842bfb95, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13100)) returned 1 [0067.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0067.316] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\ntnv41z8vtwtx5gvsqm.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\NTNv41z8vTWtX5GVSQm.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\ntnv41z8vtwtx5gvsqm.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0067.317] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods", lpFilePart=0x0) returned 0x2f [0067.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0067.317] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\q1lzjvuq5gkqrui_u-u.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.317] GetFileType (hFile=0x2d0) returned 0x1 [0067.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0067.317] GetFileType (hFile=0x2d0) returned 0x1 [0067.318] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x165df [0067.318] ReadFile (in: hFile=0x2d0, lpBuffer=0x39d5d38, nNumberOfBytesToRead=0x165df, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x39d5d38*, lpNumberOfBytesRead=0x8fe7a0*=0x165df, lpOverlapped=0x0) returned 1 [0067.319] CloseHandle (hObject=0x2d0) returned 1 [0067.443] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods", lpFilePart=0x0) returned 0x2f [0067.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0067.443] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\q1lzjvuq5gkqrui_u-u.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.444] GetFileType (hFile=0x2d0) returned 0x1 [0067.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0067.444] GetFileType (hFile=0x2d0) returned 0x1 [0067.444] WriteFile (in: hFile=0x2d0, lpBuffer=0x370ca98*, nNumberOfBytesToWrite=0x165e0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x370ca98*, lpNumberOfBytesWritten=0x8fe790*=0x165e0, lpOverlapped=0x0) returned 1 [0067.446] CloseHandle (hObject=0x2d0) returned 1 [0067.448] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods", lpFilePart=0x0) returned 0x2f [0067.448] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5a [0067.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0067.448] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\q1lzjvuq5gkqrui_u-u.ods"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f639120, ftCreationTime.dwHighDateTime=0x1d63039, ftLastAccessTime.dwLowDateTime=0x77c95a60, ftLastAccessTime.dwHighDateTime=0x1d622c3, ftLastWriteTime.dwLowDateTime=0x844170ab, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x165e0)) returned 1 [0067.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0067.448] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\q1lzjvuq5gkqrui_u-u.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\q1LzjvuQ5GKQrUI_u-u.ods.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\q1lzjvuq5gkqrui_u-u.ods.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0067.449] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3", lpFilePart=0x0) returned 0x2e [0067.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0067.449] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qhbhic1eoj3rkqx-ru.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.449] GetFileType (hFile=0x2d0) returned 0x1 [0067.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0067.449] GetFileType (hFile=0x2d0) returned 0x1 [0067.449] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xaa38 [0067.449] ReadFile (in: hFile=0x2d0, lpBuffer=0x26ee474, nNumberOfBytesToRead=0xaa38, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x26ee474*, lpNumberOfBytesRead=0x8fe7a0*=0xaa38, lpOverlapped=0x0) returned 1 [0067.449] CloseHandle (hObject=0x2d0) returned 1 [0067.579] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3", lpFilePart=0x0) returned 0x2e [0067.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0067.579] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qhbhic1eoj3rkqx-ru.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.580] GetFileType (hFile=0x2d0) returned 0x1 [0067.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0067.580] GetFileType (hFile=0x2d0) returned 0x1 [0067.580] WriteFile (in: hFile=0x2d0, lpBuffer=0x275b2a4*, nNumberOfBytesToWrite=0xaa40, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x275b2a4*, lpNumberOfBytesWritten=0x8fe790*=0xaa40, lpOverlapped=0x0) returned 1 [0067.581] CloseHandle (hObject=0x2d0) returned 1 [0067.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3", lpFilePart=0x0) returned 0x2e [0067.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x59 [0067.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0067.583] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qhbhic1eoj3rkqx-ru.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49da15a0, ftCreationTime.dwHighDateTime=0x1d62fba, ftLastAccessTime.dwLowDateTime=0xde616680, ftLastAccessTime.dwHighDateTime=0x1d62a4a, ftLastWriteTime.dwLowDateTime=0x8456fc8d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xaa40)) returned 1 [0067.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0067.583] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qhbhic1eoj3rkqx-ru.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QhBhIC1EOj3RKQX-ru.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\qhbhic1eoj3rkqx-ru.mp3.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0067.584] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv", lpFilePart=0x0) returned 0x22 [0067.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0067.584] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\uip-wb.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.584] GetFileType (hFile=0x2d0) returned 0x1 [0067.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0067.584] GetFileType (hFile=0x2d0) returned 0x1 [0067.584] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x7cb2 [0067.584] ReadFile (in: hFile=0x2d0, lpBuffer=0x2766124, nNumberOfBytesToRead=0x7cb2, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2766124*, lpNumberOfBytesRead=0x8fe7a0*=0x7cb2, lpOverlapped=0x0) returned 1 [0067.585] CloseHandle (hObject=0x2d0) returned 1 [0067.674] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv", lpFilePart=0x0) returned 0x22 [0067.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0067.674] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\uip-wb.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.675] GetFileType (hFile=0x2d0) returned 0x1 [0067.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0067.675] GetFileType (hFile=0x2d0) returned 0x1 [0067.675] WriteFile (in: hFile=0x2d0, lpBuffer=0x27d9ee8*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27d9ee8*, lpNumberOfBytesWritten=0x8fe790*=0x7cc0, lpOverlapped=0x0) returned 1 [0067.676] CloseHandle (hObject=0x2d0) returned 1 [0067.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv", lpFilePart=0x0) returned 0x22 [0067.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4d [0067.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0067.678] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\uip-wb.flv"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf72b5a0, ftCreationTime.dwHighDateTime=0x1d631f6, ftLastAccessTime.dwLowDateTime=0x5ae009b0, ftLastAccessTime.dwHighDateTime=0x1d62e7d, ftLastWriteTime.dwLowDateTime=0x846534de, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x7cc0)) returned 1 [0067.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0067.678] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\uip-wb.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Uip-WB.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\uip-wb.flv.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0067.679] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav", lpFilePart=0x0) returned 0x2f [0067.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0067.679] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\vonm4pce9xzjoyngqba.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.679] GetFileType (hFile=0x2d0) returned 0x1 [0067.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0067.679] GetFileType (hFile=0x2d0) returned 0x1 [0067.679] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x11df0 [0067.679] ReadFile (in: hFile=0x2d0, lpBuffer=0x27e1f88, nNumberOfBytesToRead=0x11df0, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27e1f88*, lpNumberOfBytesRead=0x8fe7a0*=0x11df0, lpOverlapped=0x0) returned 1 [0067.679] CloseHandle (hObject=0x2d0) returned 1 [0067.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav", lpFilePart=0x0) returned 0x2f [0067.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0067.699] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\vonm4pce9xzjoyngqba.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.700] GetFileType (hFile=0x2d0) returned 0x1 [0067.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0067.700] GetFileType (hFile=0x2d0) returned 0x1 [0067.700] WriteFile (in: hFile=0x2d0, lpBuffer=0x286479c*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x286479c*, lpNumberOfBytesWritten=0x8fe790*=0x11e00, lpOverlapped=0x0) returned 1 [0067.702] CloseHandle (hObject=0x2d0) returned 1 [0067.703] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav", lpFilePart=0x0) returned 0x2f [0067.703] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5a [0067.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0067.703] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\vonm4pce9xzjoyngqba.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd017c0, ftCreationTime.dwHighDateTime=0x1d622dc, ftLastAccessTime.dwLowDateTime=0x7caa370, ftLastAccessTime.dwHighDateTime=0x1d63288, ftLastWriteTime.dwLowDateTime=0x8467b963, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11e00)) returned 1 [0067.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0067.704] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\vonm4pce9xzjoyngqba.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vONM4Pce9XzjOYngQba.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\vonm4pce9xzjoyngqba.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0067.704] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png", lpFilePart=0x0) returned 0x2c [0067.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0067.704] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vrx-bc4qikmk9eib.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.704] GetFileType (hFile=0x2d0) returned 0x1 [0067.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0067.704] GetFileType (hFile=0x2d0) returned 0x1 [0067.705] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xc936 [0067.705] ReadFile (in: hFile=0x2d0, lpBuffer=0x28769f4, nNumberOfBytesToRead=0xc936, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28769f4*, lpNumberOfBytesRead=0x8fe7a0*=0xc936, lpOverlapped=0x0) returned 1 [0067.705] CloseHandle (hObject=0x2d0) returned 1 [0067.769] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png", lpFilePart=0x0) returned 0x2c [0067.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0067.769] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vrx-bc4qikmk9eib.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.770] GetFileType (hFile=0x2d0) returned 0x1 [0067.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0067.770] GetFileType (hFile=0x2d0) returned 0x1 [0067.770] WriteFile (in: hFile=0x2d0, lpBuffer=0x28e93cc*, nNumberOfBytesToWrite=0xc940, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x28e93cc*, lpNumberOfBytesWritten=0x8fe790*=0xc940, lpOverlapped=0x0) returned 1 [0067.771] CloseHandle (hObject=0x2d0) returned 1 [0067.773] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png", lpFilePart=0x0) returned 0x2c [0067.773] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0067.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0067.773] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vrx-bc4qikmk9eib.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb134f00, ftCreationTime.dwHighDateTime=0x1d62504, ftLastAccessTime.dwLowDateTime=0x67401800, ftLastAccessTime.dwHighDateTime=0x1d6235e, ftLastWriteTime.dwLowDateTime=0x847383f8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xc940)) returned 1 [0067.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0067.773] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vrx-bc4qikmk9eib.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\VrX-BC4QiKMK9Eib.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\vrx-bc4qikmk9eib.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0067.774] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav", lpFilePart=0x0) returned 0x23 [0067.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0067.774] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\vuj55g8.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.774] GetFileType (hFile=0x2d0) returned 0x1 [0067.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0067.774] GetFileType (hFile=0x2d0) returned 0x1 [0067.774] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x1586b [0067.774] ReadFile (in: hFile=0x2d0, lpBuffer=0x3775398, nNumberOfBytesToRead=0x1586b, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x3775398*, lpNumberOfBytesRead=0x8fe7a0*=0x1586b, lpOverlapped=0x0) returned 1 [0067.774] CloseHandle (hObject=0x2d0) returned 1 [0067.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav", lpFilePart=0x0) returned 0x23 [0067.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0067.794] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\vuj55g8.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.795] GetFileType (hFile=0x2d0) returned 0x1 [0067.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0067.795] GetFileType (hFile=0x2d0) returned 0x1 [0067.795] WriteFile (in: hFile=0x2d0, lpBuffer=0x37e0e00*, nNumberOfBytesToWrite=0x15870, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x37e0e00*, lpNumberOfBytesWritten=0x8fe790*=0x15870, lpOverlapped=0x0) returned 1 [0067.796] CloseHandle (hObject=0x2d0) returned 1 [0067.798] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav", lpFilePart=0x0) returned 0x23 [0067.798] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0067.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0067.798] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\vuj55g8.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43a41910, ftCreationTime.dwHighDateTime=0x1d62ee3, ftLastAccessTime.dwLowDateTime=0xc1c6fb00, ftLastAccessTime.dwHighDateTime=0x1d6265f, ftLastWriteTime.dwLowDateTime=0x8475e555, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15870)) returned 1 [0067.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0067.799] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\vuj55g8.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vuJ55g8.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\vuj55g8.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0067.799] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav", lpFilePart=0x0) returned 0x2f [0067.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0067.799] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\zvzbwri0listqjb_zgh.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0067.800] GetFileType (hFile=0x2d0) returned 0x1 [0067.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0067.800] GetFileType (hFile=0x2d0) returned 0x1 [0067.800] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xa2db [0067.800] ReadFile (in: hFile=0x2d0, lpBuffer=0x273a39c, nNumberOfBytesToRead=0xa2db, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x273a39c*, lpNumberOfBytesRead=0x8fe7a0*=0xa2db, lpOverlapped=0x0) returned 1 [0067.800] CloseHandle (hObject=0x2d0) returned 1 [0068.332] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav", lpFilePart=0x0) returned 0x2f [0068.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0068.333] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\zvzbwri0listqjb_zgh.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0068.380] GetFileType (hFile=0x2d0) returned 0x1 [0068.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0068.380] GetFileType (hFile=0x2d0) returned 0x1 [0068.380] WriteFile (in: hFile=0x2d0, lpBuffer=0x27ba15c*, nNumberOfBytesToWrite=0xa2e0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27ba15c*, lpNumberOfBytesWritten=0x8fe790*=0xa2e0, lpOverlapped=0x0) returned 1 [0068.381] CloseHandle (hObject=0x2d0) returned 1 [0068.442] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav", lpFilePart=0x0) returned 0x2f [0068.442] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5a [0068.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0068.442] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\zvzbwri0listqjb_zgh.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24255500, ftCreationTime.dwHighDateTime=0x1d629c9, ftLastAccessTime.dwLowDateTime=0xc207d3d0, ftLastAccessTime.dwHighDateTime=0x1d62f8f, ftLastWriteTime.dwLowDateTime=0x84d07f35, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa2e0)) returned 1 [0068.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0068.442] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\zvzbwri0listqjb_zgh.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ZvZbWRi0lisTqjb_ZGh.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\zvzbwri0listqjb_zgh.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0068.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0068.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0068.490] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x84da08aa, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x84da08aa, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0068.490] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x84da08aa, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x84da08aa, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.490] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeaf25b0, ftCreationTime.dwHighDateTime=0x1d62c77, ftLastAccessTime.dwLowDateTime=0x77e000b0, ftLastAccessTime.dwHighDateTime=0x1d6325b, ftLastWriteTime.dwLowDateTime=0x82d2717d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x138a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2MfNLy9YL.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="2MFNLY~1.MAD")) returned 1 [0068.490] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb615a320, ftCreationTime.dwHighDateTime=0x1d626d1, ftLastAccessTime.dwLowDateTime=0xb1cfd070, ftLastAccessTime.dwHighDateTime=0x1d62b21, ftLastWriteTime.dwLowDateTime=0xb1cfd070, ftLastWriteTime.dwHighDateTime=0x1d62b21, nFileSizeHigh=0x0, nFileSizeLow=0xc628, dwReserved0=0x0, dwReserved1=0x0, cFileName="4gx9Ut5lL7PMpo.pps", cAlternateFileName="4GX9UT~1.PPS")) returned 1 [0068.490] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19dc3c10, ftCreationTime.dwHighDateTime=0x1d625cf, ftLastAccessTime.dwLowDateTime=0xfc3ee020, ftLastAccessTime.dwHighDateTime=0x1d62670, ftLastWriteTime.dwLowDateTime=0x8306e534, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Vx1iEbtfzj_6u_p.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="4VX1IE~1.MAD")) returned 1 [0068.490] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdff8b0, ftCreationTime.dwHighDateTime=0x1d6307d, ftLastAccessTime.dwLowDateTime=0x6b5dcf40, ftLastAccessTime.dwHighDateTime=0x1d63254, ftLastWriteTime.dwLowDateTime=0x8325e384, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa80, dwReserved0=0x0, dwReserved1=0x0, cFileName="5SL d.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="5SLDMP~1.MAD")) returned 1 [0068.491] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6981e40, ftCreationTime.dwHighDateTime=0x1d6231b, ftLastAccessTime.dwLowDateTime=0xb2fe70c0, ftLastAccessTime.dwHighDateTime=0x1d62881, ftLastWriteTime.dwLowDateTime=0xb2fe70c0, ftLastWriteTime.dwHighDateTime=0x1d62881, nFileSizeHigh=0x0, nFileSizeLow=0x6b79, dwReserved0=0x0, dwReserved1=0x0, cFileName="5TlQxFPBKD-F.m4a", cAlternateFileName="5TLQXF~1.M4A")) returned 1 [0068.491] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7b0a10, ftCreationTime.dwHighDateTime=0x1d62383, ftLastAccessTime.dwLowDateTime=0x789eee0, ftLastAccessTime.dwHighDateTime=0x1d6272d, ftLastWriteTime.dwLowDateTime=0x833b5757, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x0, dwReserved1=0x0, cFileName="7V-eIqickbho8mYRnU.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="7V-EIQ~1.MAD")) returned 1 [0068.491] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x362a39d0, ftCreationTime.dwHighDateTime=0x1d63150, ftLastAccessTime.dwLowDateTime=0xe4c09a30, ftLastAccessTime.dwHighDateTime=0x1d62f38, ftLastWriteTime.dwLowDateTime=0x83533120, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10190, dwReserved0=0x0, dwReserved1=0x0, cFileName="7XVRurzJMiaIbWrBm-.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="7XVRUR~1.MAD")) returned 1 [0068.491] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x487c5770, ftCreationTime.dwHighDateTime=0x1d622e2, ftLastAccessTime.dwLowDateTime=0xed042110, ftLastAccessTime.dwHighDateTime=0x1d6253a, ftLastWriteTime.dwLowDateTime=0x8368a481, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cc4lI_NT2LJ.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="CC4LI_~1.MAD")) returned 1 [0068.491] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d7e700, ftCreationTime.dwHighDateTime=0x1d629f9, ftLastAccessTime.dwLowDateTime=0xe9bedca0, ftLastAccessTime.dwHighDateTime=0x1d63068, ftLastWriteTime.dwLowDateTime=0x836fccc4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="D04_R-n2DnPnWv3.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="D04_R-~1.MAD")) returned 1 [0068.491] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0068.491] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5b5740, ftCreationTime.dwHighDateTime=0x1d626c4, ftLastAccessTime.dwLowDateTime=0xa4dd4240, ftLastAccessTime.dwHighDateTime=0x1d628af, ftLastWriteTime.dwLowDateTime=0x83807be9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x17cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dQMrXkBPPmhselSrEbWM.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="DQMRXK~1.MAD")) returned 1 [0068.491] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a78360, ftCreationTime.dwHighDateTime=0x1d62e4d, ftLastAccessTime.dwLowDateTime=0xc5939610, ftLastAccessTime.dwHighDateTime=0x1d62ef4, ftLastWriteTime.dwLowDateTime=0x838c3b8b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xabc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EcydCaDQpYezzL1k6Pm.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ECYDCA~1.MAD")) returned 1 [0068.491] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636e4800, ftCreationTime.dwHighDateTime=0x1d6275a, ftLastAccessTime.dwLowDateTime=0x89857770, ftLastAccessTime.dwHighDateTime=0x1d62499, ftLastWriteTime.dwLowDateTime=0x838ea061, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x30a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENUiDg4yY9kQ.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ENUIDG~1.MAD")) returned 1 [0068.491] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbadc5cb0, ftCreationTime.dwHighDateTime=0x1d62973, ftLastAccessTime.dwLowDateTime=0xc01bed40, ftLastAccessTime.dwHighDateTime=0x1d62887, ftLastWriteTime.dwLowDateTime=0xc01bed40, ftLastWriteTime.dwHighDateTime=0x1d62887, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESg7JSMTE9OEvObqR", cAlternateFileName="ESG7JS~1")) returned 1 [0068.492] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfbf94c0, ftCreationTime.dwHighDateTime=0x1d62f1d, ftLastAccessTime.dwLowDateTime=0x8a52b940, ftLastAccessTime.dwHighDateTime=0x1d624eb, ftLastWriteTime.dwLowDateTime=0x839a8d86, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x7ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EsKgrHK14NuBXlkOEy.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ESKGRH~1.MAD")) returned 1 [0068.492] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6252bd0, ftCreationTime.dwHighDateTime=0x1d62fff, ftLastAccessTime.dwLowDateTime=0xd90ba430, ftLastAccessTime.dwHighDateTime=0x1d62d0a, ftLastWriteTime.dwLowDateTime=0x839cef5a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eW4ttRempuil.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EW4TTR~1.MAD")) returned 1 [0068.492] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73edbfd0, ftCreationTime.dwHighDateTime=0x1d62b74, ftLastAccessTime.dwLowDateTime=0x99fbcfc0, ftLastAccessTime.dwHighDateTime=0x1d627bc, ftLastWriteTime.dwLowDateTime=0x83a8db7c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15960, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eztoh.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EZTOHS~1.MAD")) returned 1 [0068.492] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b4b3c0, ftCreationTime.dwHighDateTime=0x1d62b5e, ftLastAccessTime.dwLowDateTime=0x78d5070, ftLastAccessTime.dwHighDateTime=0x1d630d4, ftLastWriteTime.dwLowDateTime=0x83ab3e1d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa570, dwReserved0=0x0, dwReserved1=0x0, cFileName="fpWjfsK _rcQW_dA.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="FPWJFS~1.MAD")) returned 1 [0068.492] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6f6f60, ftCreationTime.dwHighDateTime=0x1d62303, ftLastAccessTime.dwLowDateTime=0xfee4b670, ftLastAccessTime.dwHighDateTime=0x1d62c3c, ftLastWriteTime.dwLowDateTime=0x83c315cf, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13650, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmAISQA1IkJR5JvZJa.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="GMAISQ~1.MAD")) returned 1 [0068.492] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc32f0, ftCreationTime.dwHighDateTime=0x1d623f6, ftLastAccessTime.dwLowDateTime=0xaebce8c0, ftLastAccessTime.dwHighDateTime=0x1d62d5e, ftLastWriteTime.dwLowDateTime=0x83c7da4e, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x890, dwReserved0=0x0, dwReserved1=0x0, cFileName="GmWsVfMPD.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="GMWSVF~1.MAD")) returned 1 [0068.492] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ae02f0, ftCreationTime.dwHighDateTime=0x1d630cc, ftLastAccessTime.dwLowDateTime=0xe7cfa3a0, ftLastAccessTime.dwHighDateTime=0x1d624df, ftLastWriteTime.dwLowDateTime=0x83d88a5c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13330, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hj KDy0x-tdXgfIqynMQ.odp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HJKDY0~1.MAD")) returned 1 [0068.492] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f9c3bf0, ftCreationTime.dwHighDateTime=0x1d62930, ftLastAccessTime.dwLowDateTime=0x388f9f80, ftLastAccessTime.dwHighDateTime=0x1d62c0a, ftLastWriteTime.dwLowDateTime=0x83dd50a7, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="iO3YK VNzCJw4gGA6.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="IO3YKV~1.MAD")) returned 1 [0068.492] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cdc2c0, ftCreationTime.dwHighDateTime=0x1d62e91, ftLastAccessTime.dwLowDateTime=0x81c95980, ftLastAccessTime.dwHighDateTime=0x1d62a38, ftLastWriteTime.dwLowDateTime=0x83f06142, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11800, dwReserved0=0x0, dwReserved1=0x0, cFileName="KGT-PUjYzfU_HcwPQWdQ.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="KGT-PU~1.MAD")) returned 1 [0068.493] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x571d5230, ftCreationTime.dwHighDateTime=0x1d62502, ftLastAccessTime.dwLowDateTime=0x8166c020, ftLastAccessTime.dwHighDateTime=0x1d625a3, ftLastWriteTime.dwLowDateTime=0x84037593, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x18460, dwReserved0=0x0, dwReserved1=0x0, cFileName="KqxvOTDjB4_49_PS4p.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="KQXVOT~1.MAD")) returned 1 [0068.493] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50870110, ftCreationTime.dwHighDateTime=0x1d623c6, ftLastAccessTime.dwLowDateTime=0xe4ed2510, ftLastAccessTime.dwHighDateTime=0x1d6254b, ftLastWriteTime.dwLowDateTime=0x8405d649, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lo1L_wbbpS5.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LO1L_W~1.MAD")) returned 1 [0068.493] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb399e2d0, ftCreationTime.dwHighDateTime=0x1d626d3, ftLastAccessTime.dwLowDateTime=0xa7747510, ftLastAccessTime.dwHighDateTime=0x1d62f98, ftLastWriteTime.dwLowDateTime=0xa7747510, ftLastWriteTime.dwHighDateTime=0x1d62f98, nFileSizeHigh=0x0, nFileSizeLow=0x948b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOYhHNm-Tu.m4a", cAlternateFileName="MOYHHN~1.M4A")) returned 1 [0068.493] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde391ff0, ftCreationTime.dwHighDateTime=0x1d62d69, ftLastAccessTime.dwLowDateTime=0x7af2c2a0, ftLastAccessTime.dwHighDateTime=0x1d624ec, ftLastWriteTime.dwLowDateTime=0x84299a44, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13250, dwReserved0=0x0, dwReserved1=0x0, cFileName="nsi 1 tylYQv.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="NSI1TY~1.MAD")) returned 1 [0068.493] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1bb8d40, ftCreationTime.dwHighDateTime=0x1d626a9, ftLastAccessTime.dwLowDateTime=0xf32eeab0, ftLastAccessTime.dwHighDateTime=0x1d632a1, ftLastWriteTime.dwLowDateTime=0x842bfb95, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13100, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTNv41z8vTWtX5GVSQm.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="NTNV41~1.MAD")) returned 1 [0068.493] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ee7d2c0, ftCreationTime.dwHighDateTime=0x1d62778, ftLastAccessTime.dwLowDateTime=0xed63a830, ftLastAccessTime.dwHighDateTime=0x1d62c77, ftLastWriteTime.dwLowDateTime=0xed63a830, ftLastWriteTime.dwHighDateTime=0x1d62c77, nFileSizeHigh=0x0, nFileSizeLow=0x10a71, dwReserved0=0x0, dwReserved1=0x0, cFileName="pcxqydxPrjex.csv", cAlternateFileName="PCXQYD~1.CSV")) returned 1 [0068.493] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e4d580, ftCreationTime.dwHighDateTime=0x1d622e4, ftLastAccessTime.dwLowDateTime=0x3b30e130, ftLastAccessTime.dwHighDateTime=0x1d6250d, ftLastWriteTime.dwLowDateTime=0x3b30e130, ftLastWriteTime.dwHighDateTime=0x1d6250d, nFileSizeHigh=0x0, nFileSizeLow=0xda8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt63S2uH20sTNzqFoK.mkv", cAlternateFileName="PT63S2~1.MKV")) returned 1 [0068.493] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f639120, ftCreationTime.dwHighDateTime=0x1d63039, ftLastAccessTime.dwLowDateTime=0x77c95a60, ftLastAccessTime.dwHighDateTime=0x1d622c3, ftLastWriteTime.dwLowDateTime=0x844170ab, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x165e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="q1LzjvuQ5GKQrUI_u-u.ods.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="Q1LZJV~1.MAD")) returned 1 [0068.493] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49da15a0, ftCreationTime.dwHighDateTime=0x1d62fba, ftLastAccessTime.dwLowDateTime=0xde616680, ftLastAccessTime.dwHighDateTime=0x1d62a4a, ftLastWriteTime.dwLowDateTime=0x8456fc8d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xaa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="QhBhIC1EOj3RKQX-ru.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="QHBHIC~1.MAD")) returned 1 [0068.493] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x5b31c300, ftCreationTime.dwHighDateTime=0x1d69f56, ftLastAccessTime.dwLowDateTime=0x5bca5980, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0xeb213e00, ftLastWriteTime.dwHighDateTime=0x1d69f51, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qrej4lz7xrqQfsU3.exe", cAlternateFileName="QREJ4L~1.EXE")) returned 1 [0068.494] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf72b5a0, ftCreationTime.dwHighDateTime=0x1d631f6, ftLastAccessTime.dwLowDateTime=0x5ae009b0, ftLastAccessTime.dwHighDateTime=0x1d62e7d, ftLastWriteTime.dwLowDateTime=0x846534de, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x7cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uip-WB.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UIP-WB~1.MAD")) returned 1 [0068.494] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd017c0, ftCreationTime.dwHighDateTime=0x1d622dc, ftLastAccessTime.dwLowDateTime=0x7caa370, ftLastAccessTime.dwHighDateTime=0x1d63288, ftLastWriteTime.dwLowDateTime=0x8467b963, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="vONM4Pce9XzjOYngQba.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="VONM4P~1.MAD")) returned 1 [0068.494] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb134f00, ftCreationTime.dwHighDateTime=0x1d62504, ftLastAccessTime.dwLowDateTime=0x67401800, ftLastAccessTime.dwHighDateTime=0x1d6235e, ftLastWriteTime.dwLowDateTime=0x847383f8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xc940, dwReserved0=0x0, dwReserved1=0x0, cFileName="VrX-BC4QiKMK9Eib.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="VRX-BC~1.MAD")) returned 1 [0068.494] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43a41910, ftCreationTime.dwHighDateTime=0x1d62ee3, ftLastAccessTime.dwLowDateTime=0xc1c6fb00, ftLastAccessTime.dwHighDateTime=0x1d6265f, ftLastWriteTime.dwLowDateTime=0x8475e555, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15870, dwReserved0=0x0, dwReserved1=0x0, cFileName="vuJ55g8.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="VUJ55G~1.MAD")) returned 1 [0068.494] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24255500, ftCreationTime.dwHighDateTime=0x1d629c9, ftLastAccessTime.dwLowDateTime=0xc207d3d0, ftLastAccessTime.dwHighDateTime=0x1d62f8f, ftLastWriteTime.dwLowDateTime=0x84d07f35, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZvZbWRi0lisTqjb_ZGh.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ZVZBWR~1.MAD")) returned 1 [0068.494] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24255500, ftCreationTime.dwHighDateTime=0x1d629c9, ftLastAccessTime.dwLowDateTime=0xc207d3d0, ftLastAccessTime.dwHighDateTime=0x1d62f8f, ftLastWriteTime.dwLowDateTime=0x84d07f35, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZvZbWRi0lisTqjb_ZGh.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ZVZBWR~1.MAD")) returned 0 [0068.494] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0068.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0068.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0068.494] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR", lpFilePart=0x0) returned 0x29 [0068.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0068.494] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR", lpFilePart=0x0) returned 0x29 [0068.494] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbadc5cb0, ftCreationTime.dwHighDateTime=0x1d62973, ftLastAccessTime.dwLowDateTime=0xc01bed40, ftLastAccessTime.dwHighDateTime=0x1d62887, ftLastWriteTime.dwLowDateTime=0xc01bed40, ftLastWriteTime.dwHighDateTime=0x1d62887, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f08 [0068.495] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbadc5cb0, ftCreationTime.dwHighDateTime=0x1d62973, ftLastAccessTime.dwLowDateTime=0xc01bed40, ftLastAccessTime.dwHighDateTime=0x1d62887, ftLastWriteTime.dwLowDateTime=0xc01bed40, ftLastWriteTime.dwHighDateTime=0x1d62887, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.495] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde83530, ftCreationTime.dwHighDateTime=0x1d629cb, ftLastAccessTime.dwLowDateTime=0xe152ee50, ftLastAccessTime.dwHighDateTime=0x1d629e0, ftLastWriteTime.dwLowDateTime=0xe152ee50, ftLastWriteTime.dwHighDateTime=0x1d629e0, nFileSizeHigh=0x0, nFileSizeLow=0x133b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="4SxGnZLm.wav", cAlternateFileName="")) returned 1 [0068.495] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c37280, ftCreationTime.dwHighDateTime=0x1d62cc1, ftLastAccessTime.dwLowDateTime=0x458c9180, ftLastAccessTime.dwHighDateTime=0x1d62506, ftLastWriteTime.dwLowDateTime=0x458c9180, ftLastWriteTime.dwHighDateTime=0x1d62506, nFileSizeHigh=0x0, nFileSizeLow=0x10d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="6v56DBUGqqJ_AmY.bmp", cAlternateFileName="6V56DB~1.BMP")) returned 1 [0068.495] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe353940, ftCreationTime.dwHighDateTime=0x1d62424, ftLastAccessTime.dwLowDateTime=0xc713e070, ftLastAccessTime.dwHighDateTime=0x1d63305, ftLastWriteTime.dwLowDateTime=0xc713e070, ftLastWriteTime.dwHighDateTime=0x1d63305, nFileSizeHigh=0x0, nFileSizeLow=0x6f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="dX4OVYzA0Y2H4HdMY.mp3", cAlternateFileName="DX4OVY~1.MP3")) returned 1 [0068.495] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67737090, ftCreationTime.dwHighDateTime=0x1d622fc, ftLastAccessTime.dwLowDateTime=0x14651600, ftLastAccessTime.dwHighDateTime=0x1d62424, ftLastWriteTime.dwLowDateTime=0x14651600, ftLastWriteTime.dwHighDateTime=0x1d62424, nFileSizeHigh=0x0, nFileSizeLow=0x49c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="hdDeJ.jpg", cAlternateFileName="")) returned 1 [0068.495] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7ef4800, ftCreationTime.dwHighDateTime=0x1d62b1e, ftLastAccessTime.dwLowDateTime=0x6d457e0, ftLastAccessTime.dwHighDateTime=0x1d62c7a, ftLastWriteTime.dwLowDateTime=0x6d457e0, ftLastWriteTime.dwHighDateTime=0x1d62c7a, nFileSizeHigh=0x0, nFileSizeLow=0x99de, dwReserved0=0x0, dwReserved1=0x0, cFileName="OH5dfk1GdQOI.m4a", cAlternateFileName="OH5DFK~1.M4A")) returned 1 [0068.495] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8c5ab00, ftCreationTime.dwHighDateTime=0x1d62ddb, ftLastAccessTime.dwLowDateTime=0xc6565d80, ftLastAccessTime.dwHighDateTime=0x1d625b7, ftLastWriteTime.dwLowDateTime=0xc6565d80, ftLastWriteTime.dwHighDateTime=0x1d625b7, nFileSizeHigh=0x0, nFileSizeLow=0x168ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="rfiseuvZ8s-i2CwN.mp3", cAlternateFileName="RFISEU~1.MP3")) returned 1 [0068.495] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59cdef80, ftCreationTime.dwHighDateTime=0x1d6248f, ftLastAccessTime.dwLowDateTime=0x56fec460, ftLastAccessTime.dwHighDateTime=0x1d6308c, ftLastWriteTime.dwLowDateTime=0x56fec460, ftLastWriteTime.dwHighDateTime=0x1d6308c, nFileSizeHigh=0x0, nFileSizeLow=0x12a3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEGt4V7eTNK4Jio.m4a", cAlternateFileName="WEGT4V~1.M4A")) returned 1 [0068.495] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615a5270, ftCreationTime.dwHighDateTime=0x1d628d6, ftLastAccessTime.dwLowDateTime=0xdc960fb0, ftLastAccessTime.dwHighDateTime=0x1d62705, ftLastWriteTime.dwLowDateTime=0xdc960fb0, ftLastWriteTime.dwHighDateTime=0x1d62705, nFileSizeHigh=0x0, nFileSizeLow=0xecc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZqfBD.mp4", cAlternateFileName="")) returned 1 [0068.495] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81725870, ftCreationTime.dwHighDateTime=0x1d6288e, ftLastAccessTime.dwLowDateTime=0x8b976cf0, ftLastAccessTime.dwHighDateTime=0x1d62dac, ftLastWriteTime.dwLowDateTime=0x8b976cf0, ftLastWriteTime.dwHighDateTime=0x1d62dac, nFileSizeHigh=0x0, nFileSizeLow=0xb537, dwReserved0=0x0, dwReserved1=0x0, cFileName="_zrTKMV9i2bSXAKNGdx6.flv", cAlternateFileName="_ZRTKM~1.FLV")) returned 1 [0068.495] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.496] FindClose (in: hFindFile=0xac0f08 | out: hFindFile=0xac0f08) returned 1 [0068.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0068.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0068.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav", lpFilePart=0x0) returned 0x36 [0068.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0068.496] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\4sxgnzlm.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0068.496] GetFileType (hFile=0x2d0) returned 0x1 [0068.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0068.496] GetFileType (hFile=0x2d0) returned 0x1 [0068.496] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x133b3 [0068.496] ReadFile (in: hFile=0x2d0, lpBuffer=0x27cb574, nNumberOfBytesToRead=0x133b3, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x27cb574*, lpNumberOfBytesRead=0x8fe75c*=0x133b3, lpOverlapped=0x0) returned 1 [0068.497] CloseHandle (hObject=0x2d0) returned 1 [0068.565] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav", lpFilePart=0x0) returned 0x36 [0068.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0068.566] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\4sxgnzlm.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0068.614] GetFileType (hFile=0x2d0) returned 0x1 [0068.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0068.614] GetFileType (hFile=0x2d0) returned 0x1 [0068.614] WriteFile (in: hFile=0x2d0, lpBuffer=0x2851ecc*, nNumberOfBytesToWrite=0x133c0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2851ecc*, lpNumberOfBytesWritten=0x8fe74c*=0x133c0, lpOverlapped=0x0) returned 1 [0068.616] CloseHandle (hObject=0x2d0) returned 1 [0068.661] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav", lpFilePart=0x0) returned 0x36 [0068.661] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x61 [0068.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0068.661] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\4sxgnzlm.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde83530, ftCreationTime.dwHighDateTime=0x1d629cb, ftLastAccessTime.dwLowDateTime=0xe152ee50, ftLastAccessTime.dwHighDateTime=0x1d629e0, ftLastWriteTime.dwLowDateTime=0x84f4425b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x133c0)) returned 1 [0068.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0068.661] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\4sxgnzlm.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\4SxGnZLm.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\4sxgnzlm.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0068.757] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp", lpFilePart=0x0) returned 0x3d [0068.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0068.757] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\6v56dbugqqj_amy.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0068.758] GetFileType (hFile=0x2d0) returned 0x1 [0068.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0068.758] GetFileType (hFile=0x2d0) returned 0x1 [0068.758] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x10d44 [0068.758] ReadFile (in: hFile=0x2d0, lpBuffer=0x2865724, nNumberOfBytesToRead=0x10d44, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2865724*, lpNumberOfBytesRead=0x8fe75c*=0x10d44, lpOverlapped=0x0) returned 1 [0068.759] CloseHandle (hObject=0x2d0) returned 1 [0068.776] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp", lpFilePart=0x0) returned 0x3d [0068.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0068.776] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\6v56dbugqqj_amy.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0068.833] GetFileType (hFile=0x2d0) returned 0x1 [0068.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0068.833] GetFileType (hFile=0x2d0) returned 0x1 [0068.833] WriteFile (in: hFile=0x2d0, lpBuffer=0x28e4d28*, nNumberOfBytesToWrite=0x10d50, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28e4d28*, lpNumberOfBytesWritten=0x8fe74c*=0x10d50, lpOverlapped=0x0) returned 1 [0068.835] CloseHandle (hObject=0x2d0) returned 1 [0068.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp", lpFilePart=0x0) returned 0x3d [0068.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x68 [0068.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0068.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\6v56dbugqqj_amy.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c37280, ftCreationTime.dwHighDateTime=0x1d62cc1, ftLastAccessTime.dwLowDateTime=0x458c9180, ftLastAccessTime.dwHighDateTime=0x1d62506, ftLastWriteTime.dwLowDateTime=0x8515a2de, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10d50)) returned 1 [0068.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0068.911] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\6v56dbugqqj_amy.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\6v56DBUGqqJ_AmY.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\6v56dbugqqj_amy.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0069.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3", lpFilePart=0x0) returned 0x3f [0069.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0069.005] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\dx4ovyza0y2h4hdmy.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0069.005] GetFileType (hFile=0x2d0) returned 0x1 [0069.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0069.005] GetFileType (hFile=0x2d0) returned 0x1 [0069.005] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x6f68 [0069.007] ReadFile (in: hFile=0x2d0, lpBuffer=0x26eef18, nNumberOfBytesToRead=0x6f68, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x26eef18*, lpNumberOfBytesRead=0x8fe75c*=0x6f68, lpOverlapped=0x0) returned 1 [0069.007] CloseHandle (hObject=0x2d0) returned 1 [0069.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3", lpFilePart=0x0) returned 0x3f [0069.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0069.218] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\dx4ovyza0y2h4hdmy.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0069.270] GetFileType (hFile=0x2d0) returned 0x1 [0069.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0069.270] GetFileType (hFile=0x2d0) returned 0x1 [0069.270] WriteFile (in: hFile=0x2d0, lpBuffer=0x275eba4*, nNumberOfBytesToWrite=0x6f70, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x275eba4*, lpNumberOfBytesWritten=0x8fe74c*=0x6f70, lpOverlapped=0x0) returned 1 [0069.271] CloseHandle (hObject=0x2d0) returned 1 [0069.333] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3", lpFilePart=0x0) returned 0x3f [0069.333] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6a [0069.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0069.333] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\dx4ovyza0y2h4hdmy.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe353940, ftCreationTime.dwHighDateTime=0x1d62424, ftLastAccessTime.dwLowDateTime=0xc713e070, ftLastAccessTime.dwHighDateTime=0x1d63305, ftLastWriteTime.dwLowDateTime=0x855863e1, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x6f70)) returned 1 [0069.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0069.333] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\dx4ovyza0y2h4hdmy.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\dX4OVYzA0Y2H4HdMY.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\dx4ovyza0y2h4hdmy.mp3.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0069.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg", lpFilePart=0x0) returned 0x33 [0069.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0069.427] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\hddej.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0069.427] GetFileType (hFile=0x2d0) returned 0x1 [0069.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0069.427] GetFileType (hFile=0x2d0) returned 0x1 [0069.427] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x49c2 [0069.427] ReadFile (in: hFile=0x2d0, lpBuffer=0x2765fdc, nNumberOfBytesToRead=0x49c2, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2765fdc*, lpNumberOfBytesRead=0x8fe75c*=0x49c2, lpOverlapped=0x0) returned 1 [0069.428] CloseHandle (hObject=0x2d0) returned 1 [0069.493] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg", lpFilePart=0x0) returned 0x33 [0069.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0069.493] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\hddej.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0069.567] GetFileType (hFile=0x2d0) returned 0x1 [0069.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0069.567] GetFileType (hFile=0x2d0) returned 0x1 [0069.567] WriteFile (in: hFile=0x2d0, lpBuffer=0x27c9ef0*, nNumberOfBytesToWrite=0x49d0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27c9ef0*, lpNumberOfBytesWritten=0x8fe74c*=0x49d0, lpOverlapped=0x0) returned 1 [0069.568] CloseHandle (hObject=0x2d0) returned 1 [0069.614] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg", lpFilePart=0x0) returned 0x33 [0069.614] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5e [0069.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0069.614] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\hddej.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67737090, ftCreationTime.dwHighDateTime=0x1d622fc, ftLastAccessTime.dwLowDateTime=0x14651600, ftLastAccessTime.dwHighDateTime=0x1d62424, ftLastWriteTime.dwLowDateTime=0x8585b1e9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x49d0)) returned 1 [0069.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0069.615] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\hddej.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\hdDeJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\hddej.jpg.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0069.710] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3", lpFilePart=0x0) returned 0x3e [0069.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0069.710] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\rfiseuvz8s-i2cwn.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0069.710] GetFileType (hFile=0x2d0) returned 0x1 [0069.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0069.710] GetFileType (hFile=0x2d0) returned 0x1 [0069.710] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x168ab [0069.710] ReadFile (in: hFile=0x2d0, lpBuffer=0x383e8b0, nNumberOfBytesToRead=0x168ab, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x383e8b0*, lpNumberOfBytesRead=0x8fe75c*=0x168ab, lpOverlapped=0x0) returned 1 [0069.711] CloseHandle (hObject=0x2d0) returned 1 [0069.728] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3", lpFilePart=0x0) returned 0x3e [0069.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0069.728] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\rfiseuvz8s-i2cwn.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0069.770] GetFileType (hFile=0x2d0) returned 0x1 [0069.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0069.770] GetFileType (hFile=0x2d0) returned 0x1 [0069.770] WriteFile (in: hFile=0x2d0, lpBuffer=0x38af458*, nNumberOfBytesToWrite=0x168b0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x38af458*, lpNumberOfBytesWritten=0x8fe74c*=0x168b0, lpOverlapped=0x0) returned 1 [0069.772] CloseHandle (hObject=0x2d0) returned 1 [0069.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3", lpFilePart=0x0) returned 0x3e [0069.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x69 [0069.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0069.818] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\rfiseuvz8s-i2cwn.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8c5ab00, ftCreationTime.dwHighDateTime=0x1d62ddb, ftLastAccessTime.dwLowDateTime=0xc6565d80, ftLastAccessTime.dwHighDateTime=0x1d625b7, ftLastWriteTime.dwLowDateTime=0x85a4afb9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x168b0)) returned 1 [0069.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0069.818] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\rfiseuvz8s-i2cwn.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\rfiseuvZ8s-i2CwN.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\rfiseuvz8s-i2cwn.mp3.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0069.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4", lpFilePart=0x0) returned 0x33 [0069.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0069.824] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\zqfbd.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0069.824] GetFileType (hFile=0x2d0) returned 0x1 [0069.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0069.824] GetFileType (hFile=0x2d0) returned 0x1 [0069.824] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xecc4 [0069.825] ReadFile (in: hFile=0x2d0, lpBuffer=0x281c03c, nNumberOfBytesToRead=0xecc4, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x281c03c*, lpNumberOfBytesRead=0x8fe75c*=0xecc4, lpOverlapped=0x0) returned 1 [0069.825] CloseHandle (hObject=0x2d0) returned 1 [0069.842] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4", lpFilePart=0x0) returned 0x33 [0069.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0069.842] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\zqfbd.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0069.898] GetFileType (hFile=0x2d0) returned 0x1 [0069.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0069.898] GetFileType (hFile=0x2d0) returned 0x1 [0069.898] WriteFile (in: hFile=0x2d0, lpBuffer=0x28954c0*, nNumberOfBytesToWrite=0xecd0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28954c0*, lpNumberOfBytesWritten=0x8fe74c*=0xecd0, lpOverlapped=0x0) returned 1 [0069.899] CloseHandle (hObject=0x2d0) returned 1 [0069.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4", lpFilePart=0x0) returned 0x33 [0069.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5e [0069.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0069.958] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\zqfbd.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615a5270, ftCreationTime.dwHighDateTime=0x1d628d6, ftLastAccessTime.dwLowDateTime=0xdc960fb0, ftLastAccessTime.dwHighDateTime=0x1d62705, ftLastWriteTime.dwLowDateTime=0x85b7c3a6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xecd0)) returned 1 [0069.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0069.958] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\zqfbd.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\ZqfBD.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\zqfbd.mp4.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0070.063] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv", lpFilePart=0x0) returned 0x42 [0070.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0070.063] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\_zrtkmv9i2bsxakngdx6.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0070.063] GetFileType (hFile=0x2d0) returned 0x1 [0070.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0070.063] GetFileType (hFile=0x2d0) returned 0x1 [0070.063] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xb537 [0070.063] ReadFile (in: hFile=0x2d0, lpBuffer=0x28a4620, nNumberOfBytesToRead=0xb537, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28a4620*, lpNumberOfBytesRead=0x8fe75c*=0xb537, lpOverlapped=0x0) returned 1 [0070.064] CloseHandle (hObject=0x2d0) returned 1 [0070.083] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv", lpFilePart=0x0) returned 0x42 [0070.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0070.083] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\_zrtkmv9i2bsxakngdx6.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0070.248] GetFileType (hFile=0x2d0) returned 0x1 [0070.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0070.248] GetFileType (hFile=0x2d0) returned 0x1 [0070.248] WriteFile (in: hFile=0x2d0, lpBuffer=0x271ed0c*, nNumberOfBytesToWrite=0xb540, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x271ed0c*, lpNumberOfBytesWritten=0x8fe74c*=0xb540, lpOverlapped=0x0) returned 1 [0070.249] CloseHandle (hObject=0x2d0) returned 1 [0070.322] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv", lpFilePart=0x0) returned 0x42 [0070.322] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6d [0070.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0070.322] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\_zrtkmv9i2bsxakngdx6.flv"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81725870, ftCreationTime.dwHighDateTime=0x1d6288e, ftLastAccessTime.dwLowDateTime=0x8b976cf0, ftLastAccessTime.dwHighDateTime=0x1d62dac, ftLastWriteTime.dwLowDateTime=0x85ed1554, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xb540)) returned 1 [0070.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0070.322] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\_zrtkmv9i2bsxakngdx6.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\_zrTKMV9i2bSXAKNGdx6.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\desktop\\esg7jsmte9oevobqr\\_zrtkmv9i2bsxakngdx6.flv.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0070.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0070.474] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR", lpFilePart=0x0) returned 0x29 [0070.474] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ESg7JSMTE9OEvObqR\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbadc5cb0, ftCreationTime.dwHighDateTime=0x1d62973, ftLastAccessTime.dwLowDateTime=0x85f82257, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x85f82257, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1548 [0070.474] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbadc5cb0, ftCreationTime.dwHighDateTime=0x1d62973, ftLastAccessTime.dwLowDateTime=0x85f82257, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x85f82257, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.475] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde83530, ftCreationTime.dwHighDateTime=0x1d629cb, ftLastAccessTime.dwLowDateTime=0xe152ee50, ftLastAccessTime.dwHighDateTime=0x1d629e0, ftLastWriteTime.dwLowDateTime=0x84f4425b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x133c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4SxGnZLm.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="4SXGNZ~1.MAD")) returned 1 [0070.475] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c37280, ftCreationTime.dwHighDateTime=0x1d62cc1, ftLastAccessTime.dwLowDateTime=0x458c9180, ftLastAccessTime.dwHighDateTime=0x1d62506, ftLastWriteTime.dwLowDateTime=0x8515a2de, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="6v56DBUGqqJ_AmY.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="6V56DB~1.MAD")) returned 1 [0070.475] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe353940, ftCreationTime.dwHighDateTime=0x1d62424, ftLastAccessTime.dwLowDateTime=0xc713e070, ftLastAccessTime.dwHighDateTime=0x1d63305, ftLastWriteTime.dwLowDateTime=0x855863e1, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x6f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="dX4OVYzA0Y2H4HdMY.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="DX4OVY~1.MAD")) returned 1 [0070.475] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67737090, ftCreationTime.dwHighDateTime=0x1d622fc, ftLastAccessTime.dwLowDateTime=0x14651600, ftLastAccessTime.dwHighDateTime=0x1d62424, ftLastWriteTime.dwLowDateTime=0x8585b1e9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x49d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hdDeJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HDDEJJ~1.MAD")) returned 1 [0070.475] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7ef4800, ftCreationTime.dwHighDateTime=0x1d62b1e, ftLastAccessTime.dwLowDateTime=0x6d457e0, ftLastAccessTime.dwHighDateTime=0x1d62c7a, ftLastWriteTime.dwLowDateTime=0x6d457e0, ftLastWriteTime.dwHighDateTime=0x1d62c7a, nFileSizeHigh=0x0, nFileSizeLow=0x99de, dwReserved0=0x0, dwReserved1=0x0, cFileName="OH5dfk1GdQOI.m4a", cAlternateFileName="OH5DFK~1.M4A")) returned 1 [0070.475] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8c5ab00, ftCreationTime.dwHighDateTime=0x1d62ddb, ftLastAccessTime.dwLowDateTime=0xc6565d80, ftLastAccessTime.dwHighDateTime=0x1d625b7, ftLastWriteTime.dwLowDateTime=0x85a4afb9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x168b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rfiseuvZ8s-i2CwN.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="RFISEU~1.MAD")) returned 1 [0070.475] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59cdef80, ftCreationTime.dwHighDateTime=0x1d6248f, ftLastAccessTime.dwLowDateTime=0x56fec460, ftLastAccessTime.dwHighDateTime=0x1d6308c, ftLastWriteTime.dwLowDateTime=0x56fec460, ftLastWriteTime.dwHighDateTime=0x1d6308c, nFileSizeHigh=0x0, nFileSizeLow=0x12a3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEGt4V7eTNK4Jio.m4a", cAlternateFileName="WEGT4V~1.M4A")) returned 1 [0070.475] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615a5270, ftCreationTime.dwHighDateTime=0x1d628d6, ftLastAccessTime.dwLowDateTime=0xdc960fb0, ftLastAccessTime.dwHighDateTime=0x1d62705, ftLastWriteTime.dwLowDateTime=0x85b7c3a6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xecd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZqfBD.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ZQFBDM~1.MAD")) returned 1 [0070.476] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81725870, ftCreationTime.dwHighDateTime=0x1d6288e, ftLastAccessTime.dwLowDateTime=0x8b976cf0, ftLastAccessTime.dwHighDateTime=0x1d62dac, ftLastWriteTime.dwLowDateTime=0x85ed1554, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xb540, dwReserved0=0x0, dwReserved1=0x0, cFileName="_zrTKMV9i2bSXAKNGdx6.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="_ZRTKM~1.MAD")) returned 1 [0070.476] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81725870, ftCreationTime.dwHighDateTime=0x1d6288e, ftLastAccessTime.dwLowDateTime=0x8b976cf0, ftLastAccessTime.dwHighDateTime=0x1d62dac, ftLastWriteTime.dwLowDateTime=0x85ed1554, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xb540, dwReserved0=0x0, dwReserved1=0x0, cFileName="_zrTKMV9i2bSXAKNGdx6.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="_ZRTKM~1.MAD")) returned 0 [0070.476] FindClose (in: hFindFile=0xac1548 | out: hFindFile=0xac1548) returned 1 [0070.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0070.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0070.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0070.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0070.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0070.476] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf76f3f7, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf76f3f7, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0070.476] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf76f3f7, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf76f3f7, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.476] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2dea4b0, ftCreationTime.dwHighDateTime=0x1d5c646, ftLastAccessTime.dwLowDateTime=0x8f460920, ftLastAccessTime.dwHighDateTime=0x1d5f0bb, ftLastWriteTime.dwLowDateTime=0x8f460920, ftLastWriteTime.dwHighDateTime=0x1d5f0bb, nFileSizeHigh=0x0, nFileSizeLow=0x822a, dwReserved0=0x0, dwReserved1=0x0, cFileName="21KBVpwy6.docx", cAlternateFileName="21KBVP~1.DOC")) returned 1 [0070.477] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8410ed0, ftCreationTime.dwHighDateTime=0x1d5e09e, ftLastAccessTime.dwLowDateTime=0x73c27c0, ftLastAccessTime.dwHighDateTime=0x1d5e086, ftLastWriteTime.dwLowDateTime=0x73c27c0, ftLastWriteTime.dwHighDateTime=0x1d5e086, nFileSizeHigh=0x0, nFileSizeLow=0x5e84, dwReserved0=0x0, dwReserved1=0x0, cFileName="2j7M40YcW-5w1OYYu0.xlsx", cAlternateFileName="2J7M40~1.XLS")) returned 1 [0070.477] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30bfc90, ftCreationTime.dwHighDateTime=0x1d5f80d, ftLastAccessTime.dwLowDateTime=0x47e3ebb0, ftLastAccessTime.dwHighDateTime=0x1d5dd4c, ftLastWriteTime.dwLowDateTime=0x47e3ebb0, ftLastWriteTime.dwHighDateTime=0x1d5dd4c, nFileSizeHigh=0x0, nFileSizeLow=0x11534, dwReserved0=0x0, dwReserved1=0x0, cFileName="2nDz3OvI5Ivb4OG2.pptx", cAlternateFileName="2NDZ3O~1.PPT")) returned 1 [0070.477] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1f7f80, ftCreationTime.dwHighDateTime=0x1d62980, ftLastAccessTime.dwLowDateTime=0xeacae270, ftLastAccessTime.dwHighDateTime=0x1d63139, ftLastWriteTime.dwLowDateTime=0xeacae270, ftLastWriteTime.dwHighDateTime=0x1d63139, nFileSizeHigh=0x0, nFileSizeLow=0x18557, dwReserved0=0x0, dwReserved1=0x0, cFileName="3V wa.csv", cAlternateFileName="3VWA~1.CSV")) returned 1 [0070.477] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67fb6540, ftCreationTime.dwHighDateTime=0x1d6256d, ftLastAccessTime.dwLowDateTime=0xc6b40530, ftLastAccessTime.dwHighDateTime=0x1d62c0a, ftLastWriteTime.dwLowDateTime=0xc6b40530, ftLastWriteTime.dwHighDateTime=0x1d62c0a, nFileSizeHigh=0x0, nFileSizeLow=0x13c6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="47_ mHdfYbhadzEn_M6.pdf", cAlternateFileName="47_MHD~1.PDF")) returned 1 [0070.477] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b41d010, ftCreationTime.dwHighDateTime=0x1d6303c, ftLastAccessTime.dwLowDateTime=0xf4242b50, ftLastAccessTime.dwHighDateTime=0x1d5cbc3, ftLastWriteTime.dwLowDateTime=0xf4242b50, ftLastWriteTime.dwHighDateTime=0x1d5cbc3, nFileSizeHigh=0x0, nFileSizeLow=0xb27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="5AquFGMG0K.xlsx", cAlternateFileName="5AQUFG~1.XLS")) returned 1 [0070.477] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6862c930, ftCreationTime.dwHighDateTime=0x1d62b79, ftLastAccessTime.dwLowDateTime=0xbd009d0, ftLastAccessTime.dwHighDateTime=0x1d6303d, ftLastWriteTime.dwLowDateTime=0xbd009d0, ftLastWriteTime.dwHighDateTime=0x1d6303d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BEyCxgTO5_WZCRZ0QB0r", cAlternateFileName="BEYCXG~1")) returned 1 [0070.477] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973ae990, ftCreationTime.dwHighDateTime=0x1d5b261, ftLastAccessTime.dwLowDateTime=0x2b4a24d0, ftLastAccessTime.dwHighDateTime=0x1d60c98, ftLastWriteTime.dwLowDateTime=0x2b4a24d0, ftLastWriteTime.dwHighDateTime=0x1d60c98, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="c9BcDgJ.docx", cAlternateFileName="C9BCDG~1.DOC")) returned 1 [0070.477] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0070.477] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0070.477] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161dbd30, ftCreationTime.dwHighDateTime=0x1d625be, ftLastAccessTime.dwLowDateTime=0x804e6380, ftLastAccessTime.dwHighDateTime=0x1d623fc, ftLastWriteTime.dwLowDateTime=0x804e6380, ftLastWriteTime.dwHighDateTime=0x1d623fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hQgrfyQ NeFYiQdFnAI1", cAlternateFileName="HQGRFY~1")) returned 1 [0070.477] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53dd00, ftCreationTime.dwHighDateTime=0x1d62d56, ftLastAccessTime.dwLowDateTime=0x8aae7400, ftLastAccessTime.dwHighDateTime=0x1d624ce, ftLastWriteTime.dwLowDateTime=0x8aae7400, ftLastWriteTime.dwHighDateTime=0x1d624ce, nFileSizeHigh=0x0, nFileSizeLow=0x89d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kD4fq.ppt", cAlternateFileName="")) returned 1 [0070.477] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76d461d0, ftCreationTime.dwHighDateTime=0x1d5f0d8, ftLastAccessTime.dwLowDateTime=0x33164a40, ftLastAccessTime.dwHighDateTime=0x1d5ef3d, ftLastWriteTime.dwLowDateTime=0x33164a40, ftLastWriteTime.dwHighDateTime=0x1d5ef3d, nFileSizeHigh=0x0, nFileSizeLow=0x51ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="M9KURr9d-qMguarczg.docx", cAlternateFileName="M9KURR~1.DOC")) returned 1 [0070.478] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc714e0, ftCreationTime.dwHighDateTime=0x1d5aa64, ftLastAccessTime.dwLowDateTime=0xc5c3a9f0, ftLastAccessTime.dwHighDateTime=0x1d5ad93, ftLastWriteTime.dwLowDateTime=0xc5c3a9f0, ftLastWriteTime.dwHighDateTime=0x1d5ad93, nFileSizeHigh=0x0, nFileSizeLow=0x23ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="mp8_UVa.pptx", cAlternateFileName="MP8_UV~1.PPT")) returned 1 [0070.478] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6887540, ftCreationTime.dwHighDateTime=0x1d624c6, ftLastAccessTime.dwLowDateTime=0x71cafcb0, ftLastAccessTime.dwHighDateTime=0x1d621f9, ftLastWriteTime.dwLowDateTime=0x71cafcb0, ftLastWriteTime.dwHighDateTime=0x1d621f9, nFileSizeHigh=0x0, nFileSizeLow=0xb5eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUqIv CzF.docx", cAlternateFileName="MUQIVC~1.DOC")) returned 1 [0070.478] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0070.478] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0070.478] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0070.478] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0070.478] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0070.478] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9d1ca0, ftCreationTime.dwHighDateTime=0x1d5ea90, ftLastAccessTime.dwLowDateTime=0xcabc5e10, ftLastAccessTime.dwHighDateTime=0x1d605aa, ftLastWriteTime.dwLowDateTime=0xcabc5e10, ftLastWriteTime.dwHighDateTime=0x1d605aa, nFileSizeHigh=0x0, nFileSizeLow=0x16607, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rlLATn5NP.pptx", cAlternateFileName="RLLATN~1.PPT")) returned 1 [0070.478] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9472d90, ftCreationTime.dwHighDateTime=0x1d5caee, ftLastAccessTime.dwLowDateTime=0x1d542a20, ftLastAccessTime.dwHighDateTime=0x1d5b323, ftLastWriteTime.dwLowDateTime=0x1d542a20, ftLastWriteTime.dwHighDateTime=0x1d5b323, nFileSizeHigh=0x0, nFileSizeLow=0x426c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S2X-Af3xL9DyQeqbZN.xlsx", cAlternateFileName="S2X-AF~1.XLS")) returned 1 [0070.478] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d1b480, ftCreationTime.dwHighDateTime=0x1d5ea3b, ftLastAccessTime.dwLowDateTime=0x1762ab90, ftLastAccessTime.dwHighDateTime=0x1d5abf4, ftLastWriteTime.dwLowDateTime=0x1762ab90, ftLastWriteTime.dwHighDateTime=0x1d5abf4, nFileSizeHigh=0x0, nFileSizeLow=0x11957, dwReserved0=0x0, dwReserved1=0x0, cFileName="stcf3-Awi.xlsx", cAlternateFileName="STCF3-~1.XLS")) returned 1 [0070.478] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7284d10, ftCreationTime.dwHighDateTime=0x1d5b1b8, ftLastAccessTime.dwLowDateTime=0xd6e55c0, ftLastAccessTime.dwHighDateTime=0x1d5ba37, ftLastWriteTime.dwLowDateTime=0xd6e55c0, ftLastWriteTime.dwHighDateTime=0x1d5ba37, nFileSizeHigh=0x0, nFileSizeLow=0xfaf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="UFSVu0X.xlsx", cAlternateFileName="UFSVU0~1.XLS")) returned 1 [0070.479] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8739a6c0, ftCreationTime.dwHighDateTime=0x1d5e750, ftLastAccessTime.dwLowDateTime=0xea0e9320, ftLastAccessTime.dwHighDateTime=0x1d5d6eb, ftLastWriteTime.dwLowDateTime=0xea0e9320, ftLastWriteTime.dwHighDateTime=0x1d5d6eb, nFileSizeHigh=0x0, nFileSizeLow=0x7383, dwReserved0=0x0, dwReserved1=0x0, cFileName="uMRkCyga_.pptx", cAlternateFileName="UMRKCY~1.PPT")) returned 1 [0070.479] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33ed110, ftCreationTime.dwHighDateTime=0x1d610e0, ftLastAccessTime.dwLowDateTime=0x5ff37a30, ftLastAccessTime.dwHighDateTime=0x1d61a56, ftLastWriteTime.dwLowDateTime=0x5ff37a30, ftLastWriteTime.dwHighDateTime=0x1d61a56, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9Wtkcgqg4in01ZvcR.docx", cAlternateFileName="X9WTKC~1.DOC")) returned 1 [0070.479] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d09a7b0, ftCreationTime.dwHighDateTime=0x1d62bbc, ftLastAccessTime.dwLowDateTime=0xd0807190, ftLastAccessTime.dwHighDateTime=0x1d62c76, ftLastWriteTime.dwLowDateTime=0xd0807190, ftLastWriteTime.dwHighDateTime=0x1d62c76, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xCZNPuMghQq-fyog", cAlternateFileName="XCZNPU~1")) returned 1 [0070.479] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6cd9460, ftCreationTime.dwHighDateTime=0x1d5bb7f, ftLastAccessTime.dwLowDateTime=0x81d0ae40, ftLastAccessTime.dwHighDateTime=0x1d63214, ftLastWriteTime.dwLowDateTime=0x81d0ae40, ftLastWriteTime.dwHighDateTime=0x1d63214, nFileSizeHigh=0x0, nFileSizeLow=0x7687, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3dd.pptx", cAlternateFileName="Z3DD~1.PPT")) returned 1 [0070.479] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0070.479] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0070.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0070.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0070.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx", lpFilePart=0x0) returned 0x28 [0070.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0070.479] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx" (normalized: "c:\\users\\fd1hvy\\documents\\21kbvpwy6.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0070.479] GetFileType (hFile=0x2d0) returned 0x1 [0070.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0070.479] GetFileType (hFile=0x2d0) returned 0x1 [0070.479] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x822a [0070.479] ReadFile (in: hFile=0x2d0, lpBuffer=0x272f638, nNumberOfBytesToRead=0x822a, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x272f638*, lpNumberOfBytesRead=0x8fe7a0*=0x822a, lpOverlapped=0x0) returned 1 [0070.480] CloseHandle (hObject=0x2d0) returned 1 [0070.611] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx", lpFilePart=0x0) returned 0x28 [0070.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0070.611] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx" (normalized: "c:\\users\\fd1hvy\\documents\\21kbvpwy6.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0070.612] GetFileType (hFile=0x2d0) returned 0x1 [0070.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0070.612] GetFileType (hFile=0x2d0) returned 0x1 [0070.612] WriteFile (in: hFile=0x2d0, lpBuffer=0x27a5088*, nNumberOfBytesToWrite=0x8230, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27a5088*, lpNumberOfBytesWritten=0x8fe790*=0x8230, lpOverlapped=0x0) returned 1 [0070.613] CloseHandle (hObject=0x2d0) returned 1 [0070.615] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx", lpFilePart=0x0) returned 0x28 [0070.615] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x53 [0070.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0070.615] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx" (normalized: "c:\\users\\fd1hvy\\documents\\21kbvpwy6.docx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2dea4b0, ftCreationTime.dwHighDateTime=0x1d5c646, ftLastAccessTime.dwLowDateTime=0x8f460920, ftLastAccessTime.dwHighDateTime=0x1d5f0bb, ftLastWriteTime.dwLowDateTime=0x86256ea8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8230)) returned 1 [0070.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0070.615] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx" (normalized: "c:\\users\\fd1hvy\\documents\\21kbvpwy6.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\21KBVpwy6.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\21kbvpwy6.docx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0070.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx", lpFilePart=0x0) returned 0x31 [0070.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0070.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\2j7m40ycw-5w1oyyu0.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0070.616] GetFileType (hFile=0x2d0) returned 0x1 [0070.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0070.616] GetFileType (hFile=0x2d0) returned 0x1 [0070.616] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x5e84 [0070.616] ReadFile (in: hFile=0x2d0, lpBuffer=0x27ad6d4, nNumberOfBytesToRead=0x5e84, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27ad6d4*, lpNumberOfBytesRead=0x8fe7a0*=0x5e84, lpOverlapped=0x0) returned 1 [0070.617] CloseHandle (hObject=0x2d0) returned 1 [0070.728] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx", lpFilePart=0x0) returned 0x31 [0070.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0070.728] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\2j7m40ycw-5w1oyyu0.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0070.729] GetFileType (hFile=0x2d0) returned 0x1 [0070.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0070.729] GetFileType (hFile=0x2d0) returned 0x1 [0070.729] WriteFile (in: hFile=0x2d0, lpBuffer=0x2817da4*, nNumberOfBytesToWrite=0x5e90, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2817da4*, lpNumberOfBytesWritten=0x8fe790*=0x5e90, lpOverlapped=0x0) returned 1 [0070.730] CloseHandle (hObject=0x2d0) returned 1 [0070.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx", lpFilePart=0x0) returned 0x31 [0070.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5c [0070.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0070.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\2j7m40ycw-5w1oyyu0.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8410ed0, ftCreationTime.dwHighDateTime=0x1d5e09e, ftLastAccessTime.dwLowDateTime=0x73c27c0, ftLastAccessTime.dwHighDateTime=0x1d5e086, ftLastWriteTime.dwLowDateTime=0x86361f07, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5e90)) returned 1 [0070.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0070.732] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\2j7m40ycw-5w1oyyu0.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\2j7M40YcW-5w1OYYu0.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\2j7m40ycw-5w1oyyu0.xlsx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0070.732] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx", lpFilePart=0x0) returned 0x2f [0070.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0070.732] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2ndz3ovi5ivb4og2.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0070.732] GetFileType (hFile=0x2d0) returned 0x1 [0070.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0070.732] GetFileType (hFile=0x2d0) returned 0x1 [0070.732] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x11534 [0070.733] ReadFile (in: hFile=0x2d0, lpBuffer=0x281e0a0, nNumberOfBytesToRead=0x11534, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x281e0a0*, lpNumberOfBytesRead=0x8fe7a0*=0x11534, lpOverlapped=0x0) returned 1 [0070.733] CloseHandle (hObject=0x2d0) returned 1 [0070.750] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx", lpFilePart=0x0) returned 0x2f [0070.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0070.751] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2ndz3ovi5ivb4og2.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0070.752] GetFileType (hFile=0x2d0) returned 0x1 [0070.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0070.752] GetFileType (hFile=0x2d0) returned 0x1 [0070.752] WriteFile (in: hFile=0x2d0, lpBuffer=0x289ee74*, nNumberOfBytesToWrite=0x11540, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x289ee74*, lpNumberOfBytesWritten=0x8fe790*=0x11540, lpOverlapped=0x0) returned 1 [0070.753] CloseHandle (hObject=0x2d0) returned 1 [0070.755] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx", lpFilePart=0x0) returned 0x2f [0070.755] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5a [0070.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0070.755] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2ndz3ovi5ivb4og2.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30bfc90, ftCreationTime.dwHighDateTime=0x1d5f80d, ftLastAccessTime.dwLowDateTime=0x47e3ebb0, ftLastAccessTime.dwHighDateTime=0x1d5dd4c, ftLastWriteTime.dwLowDateTime=0x863af59f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11540)) returned 1 [0070.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0070.755] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2ndz3ovi5ivb4og2.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\2nDz3OvI5Ivb4OG2.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\2ndz3ovi5ivb4og2.pptx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0070.756] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx", lpFilePart=0x0) returned 0x29 [0070.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0070.756] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\5aqufgmg0k.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0070.756] GetFileType (hFile=0x2d0) returned 0x1 [0070.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0070.756] GetFileType (hFile=0x2d0) returned 0x1 [0070.756] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xb27c [0070.756] ReadFile (in: hFile=0x2d0, lpBuffer=0x28b0824, nNumberOfBytesToRead=0xb27c, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28b0824*, lpNumberOfBytesRead=0x8fe7a0*=0xb27c, lpOverlapped=0x0) returned 1 [0070.757] CloseHandle (hObject=0x2d0) returned 1 [0070.891] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx", lpFilePart=0x0) returned 0x29 [0070.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0070.891] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\5aqufgmg0k.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0070.892] GetFileType (hFile=0x2d0) returned 0x1 [0070.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0070.892] GetFileType (hFile=0x2d0) returned 0x1 [0070.892] WriteFile (in: hFile=0x2d0, lpBuffer=0x272b5ac*, nNumberOfBytesToWrite=0xb280, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x272b5ac*, lpNumberOfBytesWritten=0x8fe790*=0xb280, lpOverlapped=0x0) returned 1 [0070.893] CloseHandle (hObject=0x2d0) returned 1 [0070.895] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx", lpFilePart=0x0) returned 0x29 [0070.896] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x54 [0070.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0070.896] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\5aqufgmg0k.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b41d010, ftCreationTime.dwHighDateTime=0x1d6303c, ftLastAccessTime.dwLowDateTime=0xf4242b50, ftLastAccessTime.dwHighDateTime=0x1d5cbc3, ftLastWriteTime.dwLowDateTime=0x864df71f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xb280)) returned 1 [0070.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0070.896] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\5aqufgmg0k.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\5AquFGMG0K.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\5aqufgmg0k.xlsx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0070.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx", lpFilePart=0x0) returned 0x26 [0070.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0070.897] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx" (normalized: "c:\\users\\fd1hvy\\documents\\c9bcdgj.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0070.897] GetFileType (hFile=0x2d0) returned 0x1 [0070.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0070.897] GetFileType (hFile=0x2d0) returned 0x1 [0070.897] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x1f3c [0070.897] ReadFile (in: hFile=0x2d0, lpBuffer=0x2736c28, nNumberOfBytesToRead=0x1f3c, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2736c28*, lpNumberOfBytesRead=0x8fe7a0*=0x1f3c, lpOverlapped=0x0) returned 1 [0070.897] CloseHandle (hObject=0x2d0) returned 1 [0071.072] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx", lpFilePart=0x0) returned 0x26 [0071.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0071.072] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx" (normalized: "c:\\users\\fd1hvy\\documents\\c9bcdgj.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.073] GetFileType (hFile=0x2d0) returned 0x1 [0071.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0071.073] GetFileType (hFile=0x2d0) returned 0x1 [0071.073] WriteFile (in: hFile=0x2d0, lpBuffer=0x278d7c4*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x278d7c4*, lpNumberOfBytesWritten=0x8fe790*=0x1f40, lpOverlapped=0x0) returned 1 [0071.074] CloseHandle (hObject=0x2d0) returned 1 [0071.075] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx", lpFilePart=0x0) returned 0x26 [0071.075] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x51 [0071.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0071.075] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx" (normalized: "c:\\users\\fd1hvy\\documents\\c9bcdgj.docx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973ae990, ftCreationTime.dwHighDateTime=0x1d5b261, ftLastAccessTime.dwLowDateTime=0x2b4a24d0, ftLastAccessTime.dwHighDateTime=0x1d60c98, ftLastWriteTime.dwLowDateTime=0x866a9268, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1f40)) returned 1 [0071.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.075] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx" (normalized: "c:\\users\\fd1hvy\\documents\\c9bcdgj.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\c9BcDgJ.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\c9bcdgj.docx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.076] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt", lpFilePart=0x0) returned 0x23 [0071.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0071.076] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\kd4fq.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.076] GetFileType (hFile=0x2d0) returned 0x1 [0071.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0071.076] GetFileType (hFile=0x2d0) returned 0x1 [0071.076] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x89d8 [0071.076] ReadFile (in: hFile=0x2d0, lpBuffer=0x278fb08, nNumberOfBytesToRead=0x89d8, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x278fb08*, lpNumberOfBytesRead=0x8fe7a0*=0x89d8, lpOverlapped=0x0) returned 1 [0071.076] CloseHandle (hObject=0x2d0) returned 1 [0071.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt", lpFilePart=0x0) returned 0x23 [0071.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0071.094] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\kd4fq.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.095] GetFileType (hFile=0x2d0) returned 0x1 [0071.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0071.095] GetFileType (hFile=0x2d0) returned 0x1 [0071.095] WriteFile (in: hFile=0x2d0, lpBuffer=0x2807a68*, nNumberOfBytesToWrite=0x89e0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2807a68*, lpNumberOfBytesWritten=0x8fe790*=0x89e0, lpOverlapped=0x0) returned 1 [0071.096] CloseHandle (hObject=0x2d0) returned 1 [0071.097] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt", lpFilePart=0x0) returned 0x23 [0071.097] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0071.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0071.097] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\kd4fq.ppt"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53dd00, ftCreationTime.dwHighDateTime=0x1d62d56, ftLastAccessTime.dwLowDateTime=0x8aae7400, ftLastAccessTime.dwHighDateTime=0x1d624ce, ftLastWriteTime.dwLowDateTime=0x866cf4c2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x89e0)) returned 1 [0071.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.098] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\kd4fq.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\kD4fq.ppt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\kd4fq.ppt.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx", lpFilePart=0x0) returned 0x31 [0071.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0071.186] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx" (normalized: "c:\\users\\fd1hvy\\documents\\m9kurr9d-qmguarczg.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.186] GetFileType (hFile=0x2d0) returned 0x1 [0071.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0071.186] GetFileType (hFile=0x2d0) returned 0x1 [0071.186] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x51ac [0071.186] ReadFile (in: hFile=0x2d0, lpBuffer=0x2810830, nNumberOfBytesToRead=0x51ac, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2810830*, lpNumberOfBytesRead=0x8fe7a0*=0x51ac, lpOverlapped=0x0) returned 1 [0071.187] CloseHandle (hObject=0x2d0) returned 1 [0071.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx", lpFilePart=0x0) returned 0x31 [0071.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0071.349] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx" (normalized: "c:\\users\\fd1hvy\\documents\\m9kurr9d-qmguarczg.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.349] GetFileType (hFile=0x2d0) returned 0x1 [0071.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0071.349] GetFileType (hFile=0x2d0) returned 0x1 [0071.350] WriteFile (in: hFile=0x2d0, lpBuffer=0x2876ea0*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2876ea0*, lpNumberOfBytesWritten=0x8fe790*=0x51b0, lpOverlapped=0x0) returned 1 [0071.350] CloseHandle (hObject=0x2d0) returned 1 [0071.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx", lpFilePart=0x0) returned 0x31 [0071.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5c [0071.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0071.352] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx" (normalized: "c:\\users\\fd1hvy\\documents\\m9kurr9d-qmguarczg.docx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76d461d0, ftCreationTime.dwHighDateTime=0x1d5f0d8, ftLastAccessTime.dwLowDateTime=0x33164a40, ftLastAccessTime.dwHighDateTime=0x1d5ef3d, ftLastWriteTime.dwLowDateTime=0x8694031d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x51b0)) returned 1 [0071.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.352] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx" (normalized: "c:\\users\\fd1hvy\\documents\\m9kurr9d-qmguarczg.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\M9KURr9d-qMguarczg.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\m9kurr9d-qmguarczg.docx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.352] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx", lpFilePart=0x0) returned 0x26 [0071.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0071.352] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mp8_uva.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.352] GetFileType (hFile=0x2d0) returned 0x1 [0071.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0071.353] GetFileType (hFile=0x2d0) returned 0x1 [0071.353] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x23ce [0071.353] ReadFile (in: hFile=0x2d0, lpBuffer=0x287c49c, nNumberOfBytesToRead=0x23ce, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x287c49c*, lpNumberOfBytesRead=0x8fe7a0*=0x23ce, lpOverlapped=0x0) returned 1 [0071.353] CloseHandle (hObject=0x2d0) returned 1 [0071.369] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx", lpFilePart=0x0) returned 0x26 [0071.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0071.369] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mp8_uva.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.482] GetFileType (hFile=0x2d0) returned 0x1 [0071.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0071.482] GetFileType (hFile=0x2d0) returned 0x1 [0071.482] WriteFile (in: hFile=0x2d0, lpBuffer=0x28d45b0*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x28d45b0*, lpNumberOfBytesWritten=0x8fe790*=0x23d0, lpOverlapped=0x0) returned 1 [0071.482] CloseHandle (hObject=0x2d0) returned 1 [0071.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx", lpFilePart=0x0) returned 0x26 [0071.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x51 [0071.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0071.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mp8_uva.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc714e0, ftCreationTime.dwHighDateTime=0x1d5aa64, ftLastAccessTime.dwLowDateTime=0xc5c3a9f0, ftLastAccessTime.dwHighDateTime=0x1d5ad93, ftLastWriteTime.dwLowDateTime=0x86a978ca, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x23d0)) returned 1 [0071.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.484] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\mp8_uva.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\mp8_UVa.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\mp8_uva.pptx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.484] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx", lpFilePart=0x0) returned 0x28 [0071.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0071.484] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx" (normalized: "c:\\users\\fd1hvy\\documents\\muqiv czf.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.484] GetFileType (hFile=0x2d0) returned 0x1 [0071.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0071.485] GetFileType (hFile=0x2d0) returned 0x1 [0071.485] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xb5eb [0071.485] ReadFile (in: hFile=0x2d0, lpBuffer=0x28d6d68, nNumberOfBytesToRead=0xb5eb, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28d6d68*, lpNumberOfBytesRead=0x8fe7a0*=0xb5eb, lpOverlapped=0x0) returned 1 [0071.485] CloseHandle (hObject=0x2d0) returned 1 [0071.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx", lpFilePart=0x0) returned 0x28 [0071.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0071.504] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx" (normalized: "c:\\users\\fd1hvy\\documents\\muqiv czf.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.505] GetFileType (hFile=0x2d0) returned 0x1 [0071.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0071.505] GetFileType (hFile=0x2d0) returned 0x1 [0071.505] WriteFile (in: hFile=0x2d0, lpBuffer=0x275176c*, nNumberOfBytesToWrite=0xb5f0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x275176c*, lpNumberOfBytesWritten=0x8fe790*=0xb5f0, lpOverlapped=0x0) returned 1 [0071.506] CloseHandle (hObject=0x2d0) returned 1 [0071.508] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx", lpFilePart=0x0) returned 0x28 [0071.508] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x53 [0071.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0071.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx" (normalized: "c:\\users\\fd1hvy\\documents\\muqiv czf.docx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6887540, ftCreationTime.dwHighDateTime=0x1d624c6, ftLastAccessTime.dwLowDateTime=0x71cafcb0, ftLastAccessTime.dwHighDateTime=0x1d621f9, ftLastWriteTime.dwLowDateTime=0x86abdb75, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xb5f0)) returned 1 [0071.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.508] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx" (normalized: "c:\\users\\fd1hvy\\documents\\muqiv czf.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\MUqIv CzF.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\muqiv czf.docx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.508] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx", lpFilePart=0x0) returned 0x28 [0071.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0071.508] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rllatn5np.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.509] GetFileType (hFile=0x2d0) returned 0x1 [0071.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0071.509] GetFileType (hFile=0x2d0) returned 0x1 [0071.509] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x16607 [0071.509] ReadFile (in: hFile=0x2d0, lpBuffer=0x3949ca8, nNumberOfBytesToRead=0x16607, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x3949ca8*, lpNumberOfBytesRead=0x8fe7a0*=0x16607, lpOverlapped=0x0) returned 1 [0071.509] CloseHandle (hObject=0x2d0) returned 1 [0071.567] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx", lpFilePart=0x0) returned 0x28 [0071.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0071.567] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rllatn5np.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.569] GetFileType (hFile=0x2d0) returned 0x1 [0071.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0071.569] GetFileType (hFile=0x2d0) returned 0x1 [0071.569] WriteFile (in: hFile=0x2d0, lpBuffer=0x39b9b30*, nNumberOfBytesToWrite=0x16610, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x39b9b30*, lpNumberOfBytesWritten=0x8fe790*=0x16610, lpOverlapped=0x0) returned 1 [0071.570] CloseHandle (hObject=0x2d0) returned 1 [0071.572] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx", lpFilePart=0x0) returned 0x28 [0071.572] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x53 [0071.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0071.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rllatn5np.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9d1ca0, ftCreationTime.dwHighDateTime=0x1d5ea90, ftLastAccessTime.dwLowDateTime=0xcabc5e10, ftLastAccessTime.dwHighDateTime=0x1d605aa, ftLastWriteTime.dwLowDateTime=0x86b56340, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16610)) returned 1 [0071.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.573] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rllatn5np.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\rlLATn5NP.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\rllatn5np.pptx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx", lpFilePart=0x0) returned 0x31 [0071.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0071.573] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\s2x-af3xl9dyqeqbzn.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.574] GetFileType (hFile=0x2d0) returned 0x1 [0071.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0071.574] GetFileType (hFile=0x2d0) returned 0x1 [0071.574] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x426c [0071.574] ReadFile (in: hFile=0x2d0, lpBuffer=0x27aa4e0, nNumberOfBytesToRead=0x426c, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27aa4e0*, lpNumberOfBytesRead=0x8fe7a0*=0x426c, lpOverlapped=0x0) returned 1 [0071.574] CloseHandle (hObject=0x2d0) returned 1 [0071.590] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx", lpFilePart=0x0) returned 0x31 [0071.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0071.590] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\s2x-af3xl9dyqeqbzn.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.591] GetFileType (hFile=0x2d0) returned 0x1 [0071.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0071.591] GetFileType (hFile=0x2d0) returned 0x1 [0071.591] WriteFile (in: hFile=0x2d0, lpBuffer=0x280bf10*, nNumberOfBytesToWrite=0x4270, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x280bf10*, lpNumberOfBytesWritten=0x8fe790*=0x4270, lpOverlapped=0x0) returned 1 [0071.592] CloseHandle (hObject=0x2d0) returned 1 [0071.593] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx", lpFilePart=0x0) returned 0x31 [0071.593] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5c [0071.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0071.593] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\s2x-af3xl9dyqeqbzn.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9472d90, ftCreationTime.dwHighDateTime=0x1d5caee, ftLastAccessTime.dwLowDateTime=0x1d542a20, ftLastAccessTime.dwHighDateTime=0x1d5b323, ftLastWriteTime.dwLowDateTime=0x86ba29e3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4270)) returned 1 [0071.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.593] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\s2x-af3xl9dyqeqbzn.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\S2X-Af3xL9DyQeqbZN.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\s2x-af3xl9dyqeqbzn.xlsx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.594] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx", lpFilePart=0x0) returned 0x28 [0071.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0071.594] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\stcf3-awi.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.594] GetFileType (hFile=0x2d0) returned 0x1 [0071.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0071.594] GetFileType (hFile=0x2d0) returned 0x1 [0071.594] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x11957 [0071.594] ReadFile (in: hFile=0x2d0, lpBuffer=0x28105d4, nNumberOfBytesToRead=0x11957, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28105d4*, lpNumberOfBytesRead=0x8fe7a0*=0x11957, lpOverlapped=0x0) returned 1 [0071.595] CloseHandle (hObject=0x2d0) returned 1 [0071.664] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx", lpFilePart=0x0) returned 0x28 [0071.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0071.664] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\stcf3-awi.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.665] GetFileType (hFile=0x2d0) returned 0x1 [0071.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0071.665] GetFileType (hFile=0x2d0) returned 0x1 [0071.665] WriteFile (in: hFile=0x2d0, lpBuffer=0x26fea90*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x26fea90*, lpNumberOfBytesWritten=0x8fe790*=0x11960, lpOverlapped=0x0) returned 1 [0071.666] CloseHandle (hObject=0x2d0) returned 1 [0071.668] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx", lpFilePart=0x0) returned 0x28 [0071.668] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x53 [0071.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0071.668] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\stcf3-awi.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d1b480, ftCreationTime.dwHighDateTime=0x1d5ea3b, ftLastAccessTime.dwLowDateTime=0x1762ab90, ftLastAccessTime.dwHighDateTime=0x1d5abf4, ftLastWriteTime.dwLowDateTime=0x86c61563, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11960)) returned 1 [0071.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.668] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\stcf3-awi.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\stcf3-Awi.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\stcf3-awi.xlsx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.669] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx", lpFilePart=0x0) returned 0x26 [0071.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0071.669] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ufsvu0x.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.669] GetFileType (hFile=0x2d0) returned 0x1 [0071.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0071.669] GetFileType (hFile=0x2d0) returned 0x1 [0071.669] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xfaf1 [0071.669] ReadFile (in: hFile=0x2d0, lpBuffer=0x27107e4, nNumberOfBytesToRead=0xfaf1, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27107e4*, lpNumberOfBytesRead=0x8fe7a0*=0xfaf1, lpOverlapped=0x0) returned 1 [0071.670] CloseHandle (hObject=0x2d0) returned 1 [0071.761] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx", lpFilePart=0x0) returned 0x26 [0071.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0071.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ufsvu0x.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.762] GetFileType (hFile=0x2d0) returned 0x1 [0071.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0071.762] GetFileType (hFile=0x2d0) returned 0x1 [0071.762] WriteFile (in: hFile=0x2d0, lpBuffer=0x278c858*, nNumberOfBytesToWrite=0xfb00, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x278c858*, lpNumberOfBytesWritten=0x8fe790*=0xfb00, lpOverlapped=0x0) returned 1 [0071.765] CloseHandle (hObject=0x2d0) returned 1 [0071.767] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx", lpFilePart=0x0) returned 0x26 [0071.767] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x51 [0071.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0071.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ufsvu0x.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7284d10, ftCreationTime.dwHighDateTime=0x1d5b1b8, ftLastAccessTime.dwLowDateTime=0xd6e55c0, ftLastAccessTime.dwHighDateTime=0x1d5ba37, ftLastWriteTime.dwLowDateTime=0x86d46372, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfb00)) returned 1 [0071.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.767] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ufsvu0x.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\UFSVu0X.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\ufsvu0x.xlsx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx", lpFilePart=0x0) returned 0x28 [0071.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0071.768] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\umrkcyga_.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.768] GetFileType (hFile=0x2d0) returned 0x1 [0071.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0071.768] GetFileType (hFile=0x2d0) returned 0x1 [0071.768] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x7383 [0071.768] ReadFile (in: hFile=0x2d0, lpBuffer=0x279c740, nNumberOfBytesToRead=0x7383, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x279c740*, lpNumberOfBytesRead=0x8fe7a0*=0x7383, lpOverlapped=0x0) returned 1 [0071.769] CloseHandle (hObject=0x2d0) returned 1 [0071.833] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx", lpFilePart=0x0) returned 0x28 [0071.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0071.833] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\umrkcyga_.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.834] GetFileType (hFile=0x2d0) returned 0x1 [0071.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0071.835] GetFileType (hFile=0x2d0) returned 0x1 [0071.835] WriteFile (in: hFile=0x2d0, lpBuffer=0x280d714*, nNumberOfBytesToWrite=0x7390, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x280d714*, lpNumberOfBytesWritten=0x8fe790*=0x7390, lpOverlapped=0x0) returned 1 [0071.841] CloseHandle (hObject=0x2d0) returned 1 [0071.843] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx", lpFilePart=0x0) returned 0x28 [0071.843] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x53 [0071.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0071.843] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\umrkcyga_.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8739a6c0, ftCreationTime.dwHighDateTime=0x1d5e750, ftLastAccessTime.dwLowDateTime=0xea0e9320, ftLastAccessTime.dwHighDateTime=0x1d5d6eb, ftLastWriteTime.dwLowDateTime=0x86e04ea4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x7390)) returned 1 [0071.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.843] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\umrkcyga_.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\uMRkCyga_.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\umrkcyga_.pptx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.843] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx", lpFilePart=0x0) returned 0x31 [0071.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0071.844] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx" (normalized: "c:\\users\\fd1hvy\\documents\\x9wtkcgqg4in01zvcr.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.844] GetFileType (hFile=0x2d0) returned 0x1 [0071.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0071.844] GetFileType (hFile=0x2d0) returned 0x1 [0071.844] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x48dc [0071.844] ReadFile (in: hFile=0x2d0, lpBuffer=0x2814ec0, nNumberOfBytesToRead=0x48dc, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2814ec0*, lpNumberOfBytesRead=0x8fe7a0*=0x48dc, lpOverlapped=0x0) returned 1 [0071.845] CloseHandle (hObject=0x2d0) returned 1 [0071.860] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx", lpFilePart=0x0) returned 0x31 [0071.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0071.861] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx" (normalized: "c:\\users\\fd1hvy\\documents\\x9wtkcgqg4in01zvcr.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.861] GetFileType (hFile=0x2d0) returned 0x1 [0071.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0071.861] GetFileType (hFile=0x2d0) returned 0x1 [0071.861] WriteFile (in: hFile=0x2d0, lpBuffer=0x2878920*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2878920*, lpNumberOfBytesWritten=0x8fe790*=0x48e0, lpOverlapped=0x0) returned 1 [0071.863] CloseHandle (hObject=0x2d0) returned 1 [0071.864] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx", lpFilePart=0x0) returned 0x31 [0071.864] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5c [0071.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0071.864] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx" (normalized: "c:\\users\\fd1hvy\\documents\\x9wtkcgqg4in01zvcr.docx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33ed110, ftCreationTime.dwHighDateTime=0x1d610e0, ftLastAccessTime.dwLowDateTime=0x5ff37a30, ftLastAccessTime.dwHighDateTime=0x1d61a56, ftLastWriteTime.dwLowDateTime=0x86e2b17c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x48e0)) returned 1 [0071.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.864] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx" (normalized: "c:\\users\\fd1hvy\\documents\\x9wtkcgqg4in01zvcr.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\X9Wtkcgqg4in01ZvcR.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\x9wtkcgqg4in01zvcr.docx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.865] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx", lpFilePart=0x0) returned 0x23 [0071.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0071.865] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\z3dd.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.865] GetFileType (hFile=0x2d0) returned 0x1 [0071.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0071.865] GetFileType (hFile=0x2d0) returned 0x1 [0071.865] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x7687 [0071.865] ReadFile (in: hFile=0x2d0, lpBuffer=0x287d63c, nNumberOfBytesToRead=0x7687, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x287d63c*, lpNumberOfBytesRead=0x8fe7a0*=0x7687, lpOverlapped=0x0) returned 1 [0071.866] CloseHandle (hObject=0x2d0) returned 1 [0071.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx", lpFilePart=0x0) returned 0x23 [0071.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0071.914] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\z3dd.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.915] GetFileType (hFile=0x2d0) returned 0x1 [0071.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0071.916] GetFileType (hFile=0x2d0) returned 0x1 [0071.916] WriteFile (in: hFile=0x2d0, lpBuffer=0x28ef510*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x28ef510*, lpNumberOfBytesWritten=0x8fe790*=0x7690, lpOverlapped=0x0) returned 1 [0071.920] CloseHandle (hObject=0x2d0) returned 1 [0071.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx", lpFilePart=0x0) returned 0x23 [0071.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0071.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0071.921] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\z3dd.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6cd9460, ftCreationTime.dwHighDateTime=0x1d5bb7f, ftLastAccessTime.dwLowDateTime=0x81d0ae40, ftLastAccessTime.dwHighDateTime=0x1d63214, ftLastWriteTime.dwLowDateTime=0x86ec3b64, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x7690)) returned 1 [0071.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.921] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\z3dd.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\z3dd.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\z3dd.pptx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0071.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0071.922] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x86ec3b64, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x86ec3b64, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0071.922] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x86ec3b64, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x86ec3b64, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.922] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2dea4b0, ftCreationTime.dwHighDateTime=0x1d5c646, ftLastAccessTime.dwLowDateTime=0x8f460920, ftLastAccessTime.dwHighDateTime=0x1d5f0bb, ftLastWriteTime.dwLowDateTime=0x86256ea8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8230, dwReserved0=0x0, dwReserved1=0x0, cFileName="21KBVpwy6.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="21KBVP~1.MAD")) returned 1 [0071.923] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8410ed0, ftCreationTime.dwHighDateTime=0x1d5e09e, ftLastAccessTime.dwLowDateTime=0x73c27c0, ftLastAccessTime.dwHighDateTime=0x1d5e086, ftLastWriteTime.dwLowDateTime=0x86361f07, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="2j7M40YcW-5w1OYYu0.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="2J7M40~1.MAD")) returned 1 [0071.923] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30bfc90, ftCreationTime.dwHighDateTime=0x1d5f80d, ftLastAccessTime.dwLowDateTime=0x47e3ebb0, ftLastAccessTime.dwHighDateTime=0x1d5dd4c, ftLastWriteTime.dwLowDateTime=0x863af59f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11540, dwReserved0=0x0, dwReserved1=0x0, cFileName="2nDz3OvI5Ivb4OG2.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="2NDZ3O~1.MAD")) returned 1 [0071.923] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1f7f80, ftCreationTime.dwHighDateTime=0x1d62980, ftLastAccessTime.dwLowDateTime=0xeacae270, ftLastAccessTime.dwHighDateTime=0x1d63139, ftLastWriteTime.dwLowDateTime=0xeacae270, ftLastWriteTime.dwHighDateTime=0x1d63139, nFileSizeHigh=0x0, nFileSizeLow=0x18557, dwReserved0=0x0, dwReserved1=0x0, cFileName="3V wa.csv", cAlternateFileName="3VWA~1.CSV")) returned 1 [0071.923] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67fb6540, ftCreationTime.dwHighDateTime=0x1d6256d, ftLastAccessTime.dwLowDateTime=0xc6b40530, ftLastAccessTime.dwHighDateTime=0x1d62c0a, ftLastWriteTime.dwLowDateTime=0xc6b40530, ftLastWriteTime.dwHighDateTime=0x1d62c0a, nFileSizeHigh=0x0, nFileSizeLow=0x13c6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="47_ mHdfYbhadzEn_M6.pdf", cAlternateFileName="47_MHD~1.PDF")) returned 1 [0071.923] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b41d010, ftCreationTime.dwHighDateTime=0x1d6303c, ftLastAccessTime.dwLowDateTime=0xf4242b50, ftLastAccessTime.dwHighDateTime=0x1d5cbc3, ftLastWriteTime.dwLowDateTime=0x864df71f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xb280, dwReserved0=0x0, dwReserved1=0x0, cFileName="5AquFGMG0K.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="5AQUFG~1.MAD")) returned 1 [0071.923] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6862c930, ftCreationTime.dwHighDateTime=0x1d62b79, ftLastAccessTime.dwLowDateTime=0xbd009d0, ftLastAccessTime.dwHighDateTime=0x1d6303d, ftLastWriteTime.dwLowDateTime=0xbd009d0, ftLastWriteTime.dwHighDateTime=0x1d6303d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BEyCxgTO5_WZCRZ0QB0r", cAlternateFileName="BEYCXG~1")) returned 1 [0071.923] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973ae990, ftCreationTime.dwHighDateTime=0x1d5b261, ftLastAccessTime.dwLowDateTime=0x2b4a24d0, ftLastAccessTime.dwHighDateTime=0x1d60c98, ftLastWriteTime.dwLowDateTime=0x866a9268, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="c9BcDgJ.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="C9BCDG~1.MAD")) returned 1 [0071.923] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0071.923] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0071.924] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161dbd30, ftCreationTime.dwHighDateTime=0x1d625be, ftLastAccessTime.dwLowDateTime=0x804e6380, ftLastAccessTime.dwHighDateTime=0x1d623fc, ftLastWriteTime.dwLowDateTime=0x804e6380, ftLastWriteTime.dwHighDateTime=0x1d623fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hQgrfyQ NeFYiQdFnAI1", cAlternateFileName="HQGRFY~1")) returned 1 [0071.924] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53dd00, ftCreationTime.dwHighDateTime=0x1d62d56, ftLastAccessTime.dwLowDateTime=0x8aae7400, ftLastAccessTime.dwHighDateTime=0x1d624ce, ftLastWriteTime.dwLowDateTime=0x866cf4c2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x89e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kD4fq.ppt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="KD4FQP~1.MAD")) returned 1 [0071.924] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76d461d0, ftCreationTime.dwHighDateTime=0x1d5f0d8, ftLastAccessTime.dwLowDateTime=0x33164a40, ftLastAccessTime.dwHighDateTime=0x1d5ef3d, ftLastWriteTime.dwLowDateTime=0x8694031d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x51b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="M9KURr9d-qMguarczg.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="M9KURR~1.MAD")) returned 1 [0071.924] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc714e0, ftCreationTime.dwHighDateTime=0x1d5aa64, ftLastAccessTime.dwLowDateTime=0xc5c3a9f0, ftLastAccessTime.dwHighDateTime=0x1d5ad93, ftLastWriteTime.dwLowDateTime=0x86a978ca, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x23d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mp8_UVa.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="MP8_UV~1.MAD")) returned 1 [0071.924] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6887540, ftCreationTime.dwHighDateTime=0x1d624c6, ftLastAccessTime.dwLowDateTime=0x71cafcb0, ftLastAccessTime.dwHighDateTime=0x1d621f9, ftLastWriteTime.dwLowDateTime=0x86abdb75, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xb5f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUqIv CzF.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="MUQIVC~1.MAD")) returned 1 [0071.924] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0071.925] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0071.925] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0071.925] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0071.925] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0071.925] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9d1ca0, ftCreationTime.dwHighDateTime=0x1d5ea90, ftLastAccessTime.dwLowDateTime=0xcabc5e10, ftLastAccessTime.dwHighDateTime=0x1d605aa, ftLastWriteTime.dwLowDateTime=0x86b56340, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16610, dwReserved0=0x0, dwReserved1=0x0, cFileName="rlLATn5NP.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="RLLATN~1.MAD")) returned 1 [0071.925] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9472d90, ftCreationTime.dwHighDateTime=0x1d5caee, ftLastAccessTime.dwLowDateTime=0x1d542a20, ftLastAccessTime.dwHighDateTime=0x1d5b323, ftLastWriteTime.dwLowDateTime=0x86ba29e3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4270, dwReserved0=0x0, dwReserved1=0x0, cFileName="S2X-Af3xL9DyQeqbZN.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="S2X-AF~1.MAD")) returned 1 [0071.925] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d1b480, ftCreationTime.dwHighDateTime=0x1d5ea3b, ftLastAccessTime.dwLowDateTime=0x1762ab90, ftLastAccessTime.dwHighDateTime=0x1d5abf4, ftLastWriteTime.dwLowDateTime=0x86c61563, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11960, dwReserved0=0x0, dwReserved1=0x0, cFileName="stcf3-Awi.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="STCF3-~1.MAD")) returned 1 [0071.925] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7284d10, ftCreationTime.dwHighDateTime=0x1d5b1b8, ftLastAccessTime.dwLowDateTime=0xd6e55c0, ftLastAccessTime.dwHighDateTime=0x1d5ba37, ftLastWriteTime.dwLowDateTime=0x86d46372, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfb00, dwReserved0=0x0, dwReserved1=0x0, cFileName="UFSVu0X.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UFSVU0~1.MAD")) returned 1 [0071.926] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8739a6c0, ftCreationTime.dwHighDateTime=0x1d5e750, ftLastAccessTime.dwLowDateTime=0xea0e9320, ftLastAccessTime.dwHighDateTime=0x1d5d6eb, ftLastWriteTime.dwLowDateTime=0x86e04ea4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x7390, dwReserved0=0x0, dwReserved1=0x0, cFileName="uMRkCyga_.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UMRKCY~1.MAD")) returned 1 [0071.926] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33ed110, ftCreationTime.dwHighDateTime=0x1d610e0, ftLastAccessTime.dwLowDateTime=0x5ff37a30, ftLastAccessTime.dwHighDateTime=0x1d61a56, ftLastWriteTime.dwLowDateTime=0x86e2b17c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x48e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9Wtkcgqg4in01ZvcR.docx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="X9WTKC~1.MAD")) returned 1 [0071.926] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d09a7b0, ftCreationTime.dwHighDateTime=0x1d62bbc, ftLastAccessTime.dwLowDateTime=0xd0807190, ftLastAccessTime.dwHighDateTime=0x1d62c76, ftLastWriteTime.dwLowDateTime=0xd0807190, ftLastWriteTime.dwHighDateTime=0x1d62c76, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xCZNPuMghQq-fyog", cAlternateFileName="XCZNPU~1")) returned 1 [0071.926] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6cd9460, ftCreationTime.dwHighDateTime=0x1d5bb7f, ftLastAccessTime.dwLowDateTime=0x81d0ae40, ftLastAccessTime.dwHighDateTime=0x1d63214, ftLastWriteTime.dwLowDateTime=0x86ec3b64, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x7690, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3dd.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="Z3DDPP~1.MAD")) returned 1 [0071.926] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6cd9460, ftCreationTime.dwHighDateTime=0x1d5bb7f, ftLastAccessTime.dwLowDateTime=0x81d0ae40, ftLastAccessTime.dwHighDateTime=0x1d63214, ftLastWriteTime.dwLowDateTime=0x86ec3b64, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x7690, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3dd.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="Z3DDPP~1.MAD")) returned 0 [0071.926] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0071.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0071.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0071.926] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r", lpFilePart=0x0) returned 0x2e [0071.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0071.926] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r", lpFilePart=0x0) returned 0x2e [0071.926] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6862c930, ftCreationTime.dwHighDateTime=0x1d62b79, ftLastAccessTime.dwLowDateTime=0xbd009d0, ftLastAccessTime.dwHighDateTime=0x1d6303d, ftLastWriteTime.dwLowDateTime=0xbd009d0, ftLastWriteTime.dwHighDateTime=0x1d6303d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1508 [0071.927] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6862c930, ftCreationTime.dwHighDateTime=0x1d62b79, ftLastAccessTime.dwLowDateTime=0xbd009d0, ftLastAccessTime.dwHighDateTime=0x1d6303d, ftLastWriteTime.dwLowDateTime=0xbd009d0, ftLastWriteTime.dwHighDateTime=0x1d6303d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.927] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b2bb70, ftCreationTime.dwHighDateTime=0x1d62ee4, ftLastAccessTime.dwLowDateTime=0x6bfe97a0, ftLastAccessTime.dwHighDateTime=0x1d62f29, ftLastWriteTime.dwLowDateTime=0x6bfe97a0, ftLastWriteTime.dwHighDateTime=0x1d62f29, nFileSizeHigh=0x0, nFileSizeLow=0x1059c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WYX0vK1P.rtf", cAlternateFileName="")) returned 1 [0071.927] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.927] FindClose (in: hFindFile=0xac1508 | out: hFindFile=0xac1508) returned 1 [0071.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0071.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf", lpFilePart=0x0) returned 0x3b [0071.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0071.927] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\beycxgto5_wzcrz0qb0r\\wyx0vk1p.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.927] GetFileType (hFile=0x2d0) returned 0x1 [0071.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0071.927] GetFileType (hFile=0x2d0) returned 0x1 [0071.927] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x1059c [0071.927] ReadFile (in: hFile=0x2d0, lpBuffer=0x28fb724, nNumberOfBytesToRead=0x1059c, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28fb724*, lpNumberOfBytesRead=0x8fe75c*=0x1059c, lpOverlapped=0x0) returned 1 [0071.928] CloseHandle (hObject=0x2d0) returned 1 [0071.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf", lpFilePart=0x0) returned 0x3b [0071.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0071.986] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\beycxgto5_wzcrz0qb0r\\wyx0vk1p.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.987] GetFileType (hFile=0x2d0) returned 0x1 [0071.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0071.987] GetFileType (hFile=0x2d0) returned 0x1 [0071.987] WriteFile (in: hFile=0x2d0, lpBuffer=0x277c984*, nNumberOfBytesToWrite=0x105a0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x277c984*, lpNumberOfBytesWritten=0x8fe74c*=0x105a0, lpOverlapped=0x0) returned 1 [0071.988] CloseHandle (hObject=0x2d0) returned 1 [0071.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf", lpFilePart=0x0) returned 0x3b [0071.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x66 [0071.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0071.990] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\beycxgto5_wzcrz0qb0r\\wyx0vk1p.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b2bb70, ftCreationTime.dwHighDateTime=0x1d62ee4, ftLastAccessTime.dwLowDateTime=0x6bfe97a0, ftLastAccessTime.dwHighDateTime=0x1d62f29, ftLastWriteTime.dwLowDateTime=0x86f5c543, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x105a0)) returned 1 [0071.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0071.990] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\beycxgto5_wzcrz0qb0r\\wyx0vk1p.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\WYX0vK1P.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\beycxgto5_wzcrz0qb0r\\wyx0vk1p.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0071.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0071.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r", lpFilePart=0x0) returned 0x2e [0071.991] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BEyCxgTO5_WZCRZ0QB0r\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6862c930, ftCreationTime.dwHighDateTime=0x1d62b79, ftLastAccessTime.dwLowDateTime=0x86f5c543, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x86f5c543, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1548 [0071.991] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6862c930, ftCreationTime.dwHighDateTime=0x1d62b79, ftLastAccessTime.dwLowDateTime=0x86f5c543, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x86f5c543, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.992] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b2bb70, ftCreationTime.dwHighDateTime=0x1d62ee4, ftLastAccessTime.dwLowDateTime=0x6bfe97a0, ftLastAccessTime.dwHighDateTime=0x1d62f29, ftLastWriteTime.dwLowDateTime=0x86f5c543, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x105a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WYX0vK1P.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="WYX0VK~1.MAD")) returned 1 [0071.992] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b2bb70, ftCreationTime.dwHighDateTime=0x1d62ee4, ftLastAccessTime.dwLowDateTime=0x6bfe97a0, ftLastAccessTime.dwHighDateTime=0x1d62f29, ftLastWriteTime.dwLowDateTime=0x86f5c543, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x105a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WYX0vK1P.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="WYX0VK~1.MAD")) returned 0 [0071.992] FindClose (in: hFindFile=0xac1548 | out: hFindFile=0xac1548) returned 1 [0071.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0071.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1", lpFilePart=0x0) returned 0x2e [0071.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0071.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1", lpFilePart=0x0) returned 0x2e [0071.992] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161dbd30, ftCreationTime.dwHighDateTime=0x1d625be, ftLastAccessTime.dwLowDateTime=0x804e6380, ftLastAccessTime.dwHighDateTime=0x1d623fc, ftLastWriteTime.dwLowDateTime=0x804e6380, ftLastWriteTime.dwHighDateTime=0x1d623fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0071.992] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161dbd30, ftCreationTime.dwHighDateTime=0x1d625be, ftLastAccessTime.dwLowDateTime=0x804e6380, ftLastAccessTime.dwHighDateTime=0x1d623fc, ftLastWriteTime.dwLowDateTime=0x804e6380, ftLastWriteTime.dwHighDateTime=0x1d623fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.992] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef3fcf0, ftCreationTime.dwHighDateTime=0x1d62a39, ftLastAccessTime.dwLowDateTime=0x663846a0, ftLastAccessTime.dwHighDateTime=0x1d62bfe, ftLastWriteTime.dwLowDateTime=0x663846a0, ftLastWriteTime.dwHighDateTime=0x1d62bfe, nFileSizeHigh=0x0, nFileSizeLow=0x67e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="2jY_82NIvJ 6G8_4om1m.odp", cAlternateFileName="2JY_82~1.ODP")) returned 1 [0071.992] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x653411d0, ftCreationTime.dwHighDateTime=0x1d62f87, ftLastAccessTime.dwLowDateTime=0x92473a10, ftLastAccessTime.dwHighDateTime=0x1d62ce6, ftLastWriteTime.dwLowDateTime=0x92473a10, ftLastWriteTime.dwHighDateTime=0x1d62ce6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4kQ5Td-thEPQj", cAlternateFileName="4KQ5TD~1")) returned 1 [0071.993] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa01ae4a0, ftCreationTime.dwHighDateTime=0x1d62a22, ftLastAccessTime.dwLowDateTime=0x9fac8cc0, ftLastAccessTime.dwHighDateTime=0x1d63054, ftLastWriteTime.dwLowDateTime=0x9fac8cc0, ftLastWriteTime.dwHighDateTime=0x1d63054, nFileSizeHigh=0x0, nFileSizeLow=0x153dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0VAM8RMkSXuz.csv", cAlternateFileName="F0VAM8~1.CSV")) returned 1 [0071.993] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b457760, ftCreationTime.dwHighDateTime=0x1d628b3, ftLastAccessTime.dwLowDateTime=0x6db34620, ftLastAccessTime.dwHighDateTime=0x1d62cb0, ftLastWriteTime.dwLowDateTime=0x6db34620, ftLastWriteTime.dwHighDateTime=0x1d62cb0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu0uDOvG-P5Izw", cAlternateFileName="GU0UDO~1")) returned 1 [0071.993] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e22fc00, ftCreationTime.dwHighDateTime=0x1d62cf8, ftLastAccessTime.dwLowDateTime=0xc7e8e80, ftLastAccessTime.dwHighDateTime=0x1d624a6, ftLastWriteTime.dwLowDateTime=0xc7e8e80, ftLastWriteTime.dwHighDateTime=0x1d624a6, nFileSizeHigh=0x0, nFileSizeLow=0x10373, dwReserved0=0x0, dwReserved1=0x0, cFileName="OxV6 rVp6i.ots", cAlternateFileName="OXV6RV~1.OTS")) returned 1 [0071.993] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.993] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0071.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0071.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0071.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp", lpFilePart=0x0) returned 0x47 [0071.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0071.993] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\2jy_82nivj 6g8_4om1m.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0071.993] GetFileType (hFile=0x2d0) returned 0x1 [0071.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0071.993] GetFileType (hFile=0x2d0) returned 0x1 [0071.993] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x67e8 [0071.993] ReadFile (in: hFile=0x2d0, lpBuffer=0x278eeb8, nNumberOfBytesToRead=0x67e8, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x278eeb8*, lpNumberOfBytesRead=0x8fe75c*=0x67e8, lpOverlapped=0x0) returned 1 [0071.994] CloseHandle (hObject=0x2d0) returned 1 [0072.009] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp", lpFilePart=0x0) returned 0x47 [0072.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0072.009] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\2jy_82nivj 6g8_4om1m.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.058] GetFileType (hFile=0x2d0) returned 0x1 [0072.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0072.058] GetFileType (hFile=0x2d0) returned 0x1 [0072.058] WriteFile (in: hFile=0x2d0, lpBuffer=0x27fc5c4*, nNumberOfBytesToWrite=0x67f0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27fc5c4*, lpNumberOfBytesWritten=0x8fe74c*=0x67f0, lpOverlapped=0x0) returned 1 [0072.059] CloseHandle (hObject=0x2d0) returned 1 [0072.060] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp", lpFilePart=0x0) returned 0x47 [0072.060] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x72 [0072.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0072.060] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\2jy_82nivj 6g8_4om1m.odp"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef3fcf0, ftCreationTime.dwHighDateTime=0x1d62a39, ftLastAccessTime.dwLowDateTime=0x663846a0, ftLastAccessTime.dwHighDateTime=0x1d62bfe, ftLastWriteTime.dwLowDateTime=0x8701b097, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x67f0)) returned 1 [0072.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0072.060] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\2jy_82nivj 6g8_4om1m.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\2jY_82NIvJ 6G8_4om1m.odp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\2jy_82nivj 6g8_4om1m.odp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0072.061] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1", lpFilePart=0x0) returned 0x2e [0072.061] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161dbd30, ftCreationTime.dwHighDateTime=0x1d625be, ftLastAccessTime.dwLowDateTime=0x8701b097, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8701b097, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0072.061] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161dbd30, ftCreationTime.dwHighDateTime=0x1d625be, ftLastAccessTime.dwLowDateTime=0x8701b097, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8701b097, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.061] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef3fcf0, ftCreationTime.dwHighDateTime=0x1d62a39, ftLastAccessTime.dwLowDateTime=0x663846a0, ftLastAccessTime.dwHighDateTime=0x1d62bfe, ftLastWriteTime.dwLowDateTime=0x8701b097, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x67f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2jY_82NIvJ 6G8_4om1m.odp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="2JY_82~1.MAD")) returned 1 [0072.061] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x653411d0, ftCreationTime.dwHighDateTime=0x1d62f87, ftLastAccessTime.dwLowDateTime=0x92473a10, ftLastAccessTime.dwHighDateTime=0x1d62ce6, ftLastWriteTime.dwLowDateTime=0x92473a10, ftLastWriteTime.dwHighDateTime=0x1d62ce6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4kQ5Td-thEPQj", cAlternateFileName="4KQ5TD~1")) returned 1 [0072.061] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa01ae4a0, ftCreationTime.dwHighDateTime=0x1d62a22, ftLastAccessTime.dwLowDateTime=0x9fac8cc0, ftLastAccessTime.dwHighDateTime=0x1d63054, ftLastWriteTime.dwLowDateTime=0x9fac8cc0, ftLastWriteTime.dwHighDateTime=0x1d63054, nFileSizeHigh=0x0, nFileSizeLow=0x153dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0VAM8RMkSXuz.csv", cAlternateFileName="F0VAM8~1.CSV")) returned 1 [0072.062] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b457760, ftCreationTime.dwHighDateTime=0x1d628b3, ftLastAccessTime.dwLowDateTime=0x6db34620, ftLastAccessTime.dwHighDateTime=0x1d62cb0, ftLastWriteTime.dwLowDateTime=0x6db34620, ftLastWriteTime.dwHighDateTime=0x1d62cb0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu0uDOvG-P5Izw", cAlternateFileName="GU0UDO~1")) returned 1 [0072.062] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e22fc00, ftCreationTime.dwHighDateTime=0x1d62cf8, ftLastAccessTime.dwLowDateTime=0xc7e8e80, ftLastAccessTime.dwHighDateTime=0x1d624a6, ftLastWriteTime.dwLowDateTime=0xc7e8e80, ftLastWriteTime.dwHighDateTime=0x1d624a6, nFileSizeHigh=0x0, nFileSizeLow=0x10373, dwReserved0=0x0, dwReserved1=0x0, cFileName="OxV6 rVp6i.ots", cAlternateFileName="OXV6RV~1.OTS")) returned 1 [0072.062] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e22fc00, ftCreationTime.dwHighDateTime=0x1d62cf8, ftLastAccessTime.dwLowDateTime=0xc7e8e80, ftLastAccessTime.dwHighDateTime=0x1d624a6, ftLastWriteTime.dwLowDateTime=0xc7e8e80, ftLastWriteTime.dwHighDateTime=0x1d624a6, nFileSizeHigh=0x0, nFileSizeLow=0x10373, dwReserved0=0x0, dwReserved1=0x0, cFileName="OxV6 rVp6i.ots", cAlternateFileName="OXV6RV~1.OTS")) returned 0 [0072.062] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0072.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0072.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0072.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj", nBufferLength=0x105, lpBuffer=0x8fe250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj", lpFilePart=0x0) returned 0x3c [0072.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0072.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj", lpFilePart=0x0) returned 0x3c [0072.062] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x653411d0, ftCreationTime.dwHighDateTime=0x1d62f87, ftLastAccessTime.dwLowDateTime=0x92473a10, ftLastAccessTime.dwHighDateTime=0x1d62ce6, ftLastWriteTime.dwLowDateTime=0x92473a10, ftLastWriteTime.dwHighDateTime=0x1d62ce6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f88 [0072.062] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x653411d0, ftCreationTime.dwHighDateTime=0x1d62f87, ftLastAccessTime.dwLowDateTime=0x92473a10, ftLastAccessTime.dwHighDateTime=0x1d62ce6, ftLastWriteTime.dwLowDateTime=0x92473a10, ftLastWriteTime.dwHighDateTime=0x1d62ce6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.062] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792c17d0, ftCreationTime.dwHighDateTime=0x1d6266a, ftLastAccessTime.dwLowDateTime=0x2c5186a0, ftLastAccessTime.dwHighDateTime=0x1d6280b, ftLastWriteTime.dwLowDateTime=0x2c5186a0, ftLastWriteTime.dwHighDateTime=0x1d6280b, nFileSizeHigh=0x0, nFileSizeLow=0x17e1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9lFmD9s8gY3-9.ppt", cAlternateFileName="9LFMD9~1.PPT")) returned 1 [0072.062] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bf88a80, ftCreationTime.dwHighDateTime=0x1d6312e, ftLastAccessTime.dwLowDateTime=0xf926ef60, ftLastAccessTime.dwHighDateTime=0x1d62b1e, ftLastWriteTime.dwLowDateTime=0xf926ef60, ftLastWriteTime.dwHighDateTime=0x1d62b1e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tw_XJguLeJ_6QR", cAlternateFileName="TW_XJG~1")) returned 1 [0072.063] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bf88a80, ftCreationTime.dwHighDateTime=0x1d6312e, ftLastAccessTime.dwLowDateTime=0xf926ef60, ftLastAccessTime.dwHighDateTime=0x1d62b1e, ftLastWriteTime.dwLowDateTime=0xf926ef60, ftLastWriteTime.dwHighDateTime=0x1d62b1e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tw_XJguLeJ_6QR", cAlternateFileName="TW_XJG~1")) returned 0 [0072.063] FindClose (in: hFindFile=0xac0f88 | out: hFindFile=0xac0f88) returned 1 [0072.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0072.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0072.063] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt", lpFilePart=0x0) returned 0x4e [0072.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0072.063] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\9lfmd9s8gy3-9.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.063] GetFileType (hFile=0x2d0) returned 0x1 [0072.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0072.063] GetFileType (hFile=0x2d0) returned 0x1 [0072.063] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x17e1d [0072.064] ReadFile (in: hFile=0x2d0, lpBuffer=0x372cce8, nNumberOfBytesToRead=0x17e1d, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x372cce8*, lpNumberOfBytesRead=0x8fe718*=0x17e1d, lpOverlapped=0x0) returned 1 [0072.065] CloseHandle (hObject=0x2d0) returned 1 [0072.090] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt", lpFilePart=0x0) returned 0x4e [0072.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0072.090] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\9lfmd9s8gy3-9.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.091] GetFileType (hFile=0x2d0) returned 0x1 [0072.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0072.091] GetFileType (hFile=0x2d0) returned 0x1 [0072.091] WriteFile (in: hFile=0x2d0, lpBuffer=0x37a43c8*, nNumberOfBytesToWrite=0x17e20, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x37a43c8*, lpNumberOfBytesWritten=0x8fe708*=0x17e20, lpOverlapped=0x0) returned 1 [0072.093] CloseHandle (hObject=0x2d0) returned 1 [0072.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt", lpFilePart=0x0) returned 0x4e [0072.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x79 [0072.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0072.095] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\9lfmd9s8gy3-9.ppt"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792c17d0, ftCreationTime.dwHighDateTime=0x1d6266a, ftLastAccessTime.dwLowDateTime=0x2c5186a0, ftLastAccessTime.dwHighDateTime=0x1d6280b, ftLastWriteTime.dwLowDateTime=0x87067596, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x17e20)) returned 1 [0072.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0072.095] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\9lfmd9s8gy3-9.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\9lFmD9s8gY3-9.ppt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\9lfmd9s8gy3-9.ppt.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0072.207] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj", lpFilePart=0x0) returned 0x3c [0072.207] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x653411d0, ftCreationTime.dwHighDateTime=0x1d62f87, ftLastAccessTime.dwLowDateTime=0x871725bd, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x871725bd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0072.207] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x653411d0, ftCreationTime.dwHighDateTime=0x1d62f87, ftLastAccessTime.dwLowDateTime=0x871725bd, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x871725bd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.207] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x792c17d0, ftCreationTime.dwHighDateTime=0x1d6266a, ftLastAccessTime.dwLowDateTime=0x2c5186a0, ftLastAccessTime.dwHighDateTime=0x1d6280b, ftLastWriteTime.dwLowDateTime=0x87067596, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x17e20, dwReserved0=0x0, dwReserved1=0x0, cFileName="9lFmD9s8gY3-9.ppt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="9LFMD9~1.MAD")) returned 1 [0072.207] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bf88a80, ftCreationTime.dwHighDateTime=0x1d6312e, ftLastAccessTime.dwLowDateTime=0xf926ef60, ftLastAccessTime.dwHighDateTime=0x1d62b1e, ftLastWriteTime.dwLowDateTime=0xf926ef60, ftLastWriteTime.dwHighDateTime=0x1d62b1e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tw_XJguLeJ_6QR", cAlternateFileName="TW_XJG~1")) returned 1 [0072.207] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.207] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0072.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0072.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0072.207] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR", nBufferLength=0x105, lpBuffer=0x8fe20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR", lpFilePart=0x0) returned 0x4b [0072.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0072.208] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR", nBufferLength=0x105, lpBuffer=0x8fe1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR", lpFilePart=0x0) returned 0x4b [0072.208] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\*", lpFindFileData=0x8fe44c | out: lpFindFileData=0x8fe44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bf88a80, ftCreationTime.dwHighDateTime=0x1d6312e, ftLastAccessTime.dwLowDateTime=0xf926ef60, ftLastAccessTime.dwHighDateTime=0x1d62b1e, ftLastWriteTime.dwLowDateTime=0xf926ef60, ftLastWriteTime.dwHighDateTime=0x1d62b1e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f88 [0072.208] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bf88a80, ftCreationTime.dwHighDateTime=0x1d6312e, ftLastAccessTime.dwLowDateTime=0xf926ef60, ftLastAccessTime.dwHighDateTime=0x1d62b1e, ftLastWriteTime.dwLowDateTime=0xf926ef60, ftLastWriteTime.dwHighDateTime=0x1d62b1e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.208] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73525ed0, ftCreationTime.dwHighDateTime=0x1d62e14, ftLastAccessTime.dwLowDateTime=0xda232060, ftLastAccessTime.dwHighDateTime=0x1d622d2, ftLastWriteTime.dwLowDateTime=0xda232060, ftLastWriteTime.dwHighDateTime=0x1d622d2, nFileSizeHigh=0x0, nFileSizeLow=0xf211, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pVQ_z815ISdKj.ots", cAlternateFileName="90PVQ_~1.OTS")) returned 1 [0072.208] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a749f80, ftCreationTime.dwHighDateTime=0x1d62bd1, ftLastAccessTime.dwLowDateTime=0xb6301be0, ftLastAccessTime.dwHighDateTime=0x1d62e17, ftLastWriteTime.dwLowDateTime=0xb6301be0, ftLastWriteTime.dwHighDateTime=0x1d62e17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NbpY c", cAlternateFileName="NBPYC~1")) returned 1 [0072.208] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376956a0, ftCreationTime.dwHighDateTime=0x1d631aa, ftLastAccessTime.dwLowDateTime=0xb6e004a0, ftLastAccessTime.dwHighDateTime=0x1d62d4b, ftLastWriteTime.dwLowDateTime=0xb6e004a0, ftLastWriteTime.dwHighDateTime=0x1d62d4b, nFileSizeHigh=0x0, nFileSizeLow=0x188f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TpVrMA.csv", cAlternateFileName="")) returned 1 [0072.208] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.208] FindClose (in: hFindFile=0xac0f88 | out: hFindFile=0xac0f88) returned 1 [0072.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6e0) returned 1 [0072.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0072.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0072.209] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR", nBufferLength=0x105, lpBuffer=0x8fe1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR", lpFilePart=0x0) returned 0x4b [0072.209] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\*", lpFindFileData=0x8fe44c | out: lpFindFileData=0x8fe44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bf88a80, ftCreationTime.dwHighDateTime=0x1d6312e, ftLastAccessTime.dwLowDateTime=0xf926ef60, ftLastAccessTime.dwHighDateTime=0x1d62b1e, ftLastWriteTime.dwLowDateTime=0xf926ef60, ftLastWriteTime.dwHighDateTime=0x1d62b1e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0072.209] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bf88a80, ftCreationTime.dwHighDateTime=0x1d6312e, ftLastAccessTime.dwLowDateTime=0xf926ef60, ftLastAccessTime.dwHighDateTime=0x1d62b1e, ftLastWriteTime.dwLowDateTime=0xf926ef60, ftLastWriteTime.dwHighDateTime=0x1d62b1e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.209] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73525ed0, ftCreationTime.dwHighDateTime=0x1d62e14, ftLastAccessTime.dwLowDateTime=0xda232060, ftLastAccessTime.dwHighDateTime=0x1d622d2, ftLastWriteTime.dwLowDateTime=0xda232060, ftLastWriteTime.dwHighDateTime=0x1d622d2, nFileSizeHigh=0x0, nFileSizeLow=0xf211, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pVQ_z815ISdKj.ots", cAlternateFileName="90PVQ_~1.OTS")) returned 1 [0072.209] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a749f80, ftCreationTime.dwHighDateTime=0x1d62bd1, ftLastAccessTime.dwLowDateTime=0xb6301be0, ftLastAccessTime.dwHighDateTime=0x1d62e17, ftLastWriteTime.dwLowDateTime=0xb6301be0, ftLastWriteTime.dwHighDateTime=0x1d62e17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NbpY c", cAlternateFileName="NBPYC~1")) returned 1 [0072.209] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376956a0, ftCreationTime.dwHighDateTime=0x1d631aa, ftLastAccessTime.dwLowDateTime=0xb6e004a0, ftLastAccessTime.dwHighDateTime=0x1d62d4b, ftLastWriteTime.dwLowDateTime=0xb6e004a0, ftLastWriteTime.dwHighDateTime=0x1d62d4b, nFileSizeHigh=0x0, nFileSizeLow=0x188f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TpVrMA.csv", cAlternateFileName="")) returned 1 [0072.209] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376956a0, ftCreationTime.dwHighDateTime=0x1d631aa, ftLastAccessTime.dwLowDateTime=0xb6e004a0, ftLastAccessTime.dwHighDateTime=0x1d62d4b, ftLastWriteTime.dwLowDateTime=0xb6e004a0, ftLastWriteTime.dwHighDateTime=0x1d62d4b, nFileSizeHigh=0x0, nFileSizeLow=0x188f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TpVrMA.csv", cAlternateFileName="")) returned 0 [0072.209] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0072.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6e0) returned 1 [0072.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0072.209] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c", nBufferLength=0x105, lpBuffer=0x8fe1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c", lpFilePart=0x0) returned 0x52 [0072.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0072.209] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c", nBufferLength=0x105, lpBuffer=0x8fe194, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c", lpFilePart=0x0) returned 0x52 [0072.210] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\*", lpFindFileData=0x8fe408 | out: lpFindFileData=0x8fe408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a749f80, ftCreationTime.dwHighDateTime=0x1d62bd1, ftLastAccessTime.dwLowDateTime=0xb6301be0, ftLastAccessTime.dwHighDateTime=0x1d62e17, ftLastWriteTime.dwLowDateTime=0xb6301be0, ftLastWriteTime.dwHighDateTime=0x1d62e17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1008 [0072.210] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe414 | out: lpFindFileData=0x8fe414*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a749f80, ftCreationTime.dwHighDateTime=0x1d62bd1, ftLastAccessTime.dwLowDateTime=0xb6301be0, ftLastAccessTime.dwHighDateTime=0x1d62e17, ftLastWriteTime.dwLowDateTime=0xb6301be0, ftLastWriteTime.dwHighDateTime=0x1d62e17, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.210] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe414 | out: lpFindFileData=0x8fe414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72919a90, ftCreationTime.dwHighDateTime=0x1d623c6, ftLastAccessTime.dwLowDateTime=0xc0cb2b80, ftLastAccessTime.dwHighDateTime=0x1d632b8, ftLastWriteTime.dwLowDateTime=0xc0cb2b80, ftLastWriteTime.dwHighDateTime=0x1d632b8, nFileSizeHigh=0x0, nFileSizeLow=0xbc1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="e Msl NH5-YXxZQG0.xlsx", cAlternateFileName="EMSLNH~1.XLS")) returned 1 [0072.210] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe414 | out: lpFindFileData=0x8fe414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f5d8e50, ftCreationTime.dwHighDateTime=0x1d63094, ftLastAccessTime.dwLowDateTime=0x890d2710, ftLastAccessTime.dwHighDateTime=0x1d62481, ftLastWriteTime.dwLowDateTime=0x890d2710, ftLastWriteTime.dwHighDateTime=0x1d62481, nFileSizeHigh=0x0, nFileSizeLow=0xe602, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qi8Cq.odp", cAlternateFileName="")) returned 1 [0072.210] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe414 | out: lpFindFileData=0x8fe414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x667ae1a0, ftCreationTime.dwHighDateTime=0x1d62bc1, ftLastAccessTime.dwLowDateTime=0xd43b81f0, ftLastAccessTime.dwHighDateTime=0x1d62ee0, ftLastWriteTime.dwLowDateTime=0xd43b81f0, ftLastWriteTime.dwHighDateTime=0x1d62ee0, nFileSizeHigh=0x0, nFileSizeLow=0x99c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="wftPRDectil5_77rL.xlsx", cAlternateFileName="WFTPRD~1.XLS")) returned 1 [0072.210] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe414 | out: lpFindFileData=0x8fe414*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.210] FindClose (in: hFindFile=0xac1008 | out: hFindFile=0xac1008) returned 1 [0072.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe69c) returned 1 [0072.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6a8) returned 1 [0072.210] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx", nBufferLength=0x105, lpBuffer=0x8fe0a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx", lpFilePart=0x0) returned 0x69 [0072.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe5e8) returned 1 [0072.210] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\e msl nh5-yxxzqg0.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.210] GetFileType (hFile=0x2d0) returned 0x1 [0072.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe5e4) returned 1 [0072.211] GetFileType (hFile=0x2d0) returned 0x1 [0072.211] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe6e4 | out: lpFileSizeHigh=0x8fe6e4*=0x0) returned 0xbc1e [0072.211] ReadFile (in: hFile=0x2d0, lpBuffer=0x2856794, nNumberOfBytesToRead=0xbc1e, lpNumberOfBytesRead=0x8fe690, lpOverlapped=0x0 | out: lpBuffer=0x2856794*, lpNumberOfBytesRead=0x8fe690*=0xbc1e, lpOverlapped=0x0) returned 1 [0072.211] CloseHandle (hObject=0x2d0) returned 1 [0072.228] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx", nBufferLength=0x105, lpBuffer=0x8fe08c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx", lpFilePart=0x0) returned 0x69 [0072.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe5d0) returned 1 [0072.228] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\e msl nh5-yxxzqg0.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.232] GetFileType (hFile=0x2d0) returned 0x1 [0072.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe5cc) returned 1 [0072.232] GetFileType (hFile=0x2d0) returned 0x1 [0072.232] WriteFile (in: hFile=0x2d0, lpBuffer=0x28c6a0c*, nNumberOfBytesToWrite=0xbc20, lpNumberOfBytesWritten=0x8fe680, lpOverlapped=0x0 | out: lpBuffer=0x28c6a0c*, lpNumberOfBytesWritten=0x8fe680*=0xbc20, lpOverlapped=0x0) returned 1 [0072.233] CloseHandle (hObject=0x2d0) returned 1 [0072.235] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx", lpFilePart=0x0) returned 0x69 [0072.235] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x94 [0072.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe668) returned 1 [0072.235] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\e msl nh5-yxxzqg0.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fe6e4 | out: lpFileInformation=0x8fe6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72919a90, ftCreationTime.dwHighDateTime=0x1d623c6, ftLastAccessTime.dwLowDateTime=0xc0cb2b80, ftLastAccessTime.dwHighDateTime=0x1d632b8, ftLastWriteTime.dwLowDateTime=0x871bea62, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xbc20)) returned 1 [0072.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe664) returned 1 [0072.235] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\e msl nh5-yxxzqg0.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\e Msl NH5-YXxZQG0.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\e msl nh5-yxxzqg0.xlsx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.236] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp", nBufferLength=0x105, lpBuffer=0x8fe0a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp", lpFilePart=0x0) returned 0x5c [0072.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe5e8) returned 1 [0072.236] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\qi8cq.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.236] GetFileType (hFile=0x2d0) returned 0x1 [0072.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe5e4) returned 1 [0072.236] GetFileType (hFile=0x2d0) returned 0x1 [0072.236] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe6e4 | out: lpFileSizeHigh=0x8fe6e4*=0x0) returned 0xe602 [0072.236] ReadFile (in: hFile=0x2d0, lpBuffer=0x28d2c9c, nNumberOfBytesToRead=0xe602, lpNumberOfBytesRead=0x8fe690, lpOverlapped=0x0 | out: lpBuffer=0x28d2c9c*, lpNumberOfBytesRead=0x8fe690*=0xe602, lpOverlapped=0x0) returned 1 [0072.237] CloseHandle (hObject=0x2d0) returned 1 [0072.324] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp", nBufferLength=0x105, lpBuffer=0x8fe08c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp", lpFilePart=0x0) returned 0x5c [0072.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe5d0) returned 1 [0072.324] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\qi8cq.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.325] GetFileType (hFile=0x2d0) returned 0x1 [0072.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe5cc) returned 1 [0072.325] GetFileType (hFile=0x2d0) returned 0x1 [0072.325] WriteFile (in: hFile=0x2d0, lpBuffer=0x2759f7c*, nNumberOfBytesToWrite=0xe610, lpNumberOfBytesWritten=0x8fe680, lpOverlapped=0x0 | out: lpBuffer=0x2759f7c*, lpNumberOfBytesWritten=0x8fe680*=0xe610, lpOverlapped=0x0) returned 1 [0072.326] CloseHandle (hObject=0x2d0) returned 1 [0072.328] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp", lpFilePart=0x0) returned 0x5c [0072.328] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x87 [0072.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe668) returned 1 [0072.328] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\qi8cq.odp"), fInfoLevelId=0x0, lpFileInformation=0x8fe6e4 | out: lpFileInformation=0x8fe6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f5d8e50, ftCreationTime.dwHighDateTime=0x1d63094, ftLastAccessTime.dwLowDateTime=0x890d2710, ftLastAccessTime.dwHighDateTime=0x1d62481, ftLastWriteTime.dwLowDateTime=0x872a3fbf, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe610)) returned 1 [0072.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe664) returned 1 [0072.328] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\qi8cq.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\Qi8Cq.odp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\qi8cq.odp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.329] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx", nBufferLength=0x105, lpBuffer=0x8fe0a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx", lpFilePart=0x0) returned 0x69 [0072.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe5e8) returned 1 [0072.329] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\wftprdectil5_77rl.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.329] GetFileType (hFile=0x2d0) returned 0x1 [0072.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe5e4) returned 1 [0072.329] GetFileType (hFile=0x2d0) returned 0x1 [0072.329] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe6e4 | out: lpFileSizeHigh=0x8fe6e4*=0x0) returned 0x99c6 [0072.329] ReadFile (in: hFile=0x2d0, lpBuffer=0x2768bac, nNumberOfBytesToRead=0x99c6, lpNumberOfBytesRead=0x8fe690, lpOverlapped=0x0 | out: lpBuffer=0x2768bac*, lpNumberOfBytesRead=0x8fe690*=0x99c6, lpOverlapped=0x0) returned 1 [0072.329] CloseHandle (hObject=0x2d0) returned 1 [0072.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx", nBufferLength=0x105, lpBuffer=0x8fe08c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx", lpFilePart=0x0) returned 0x69 [0072.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe5d0) returned 1 [0072.395] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\wftprdectil5_77rl.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.396] GetFileType (hFile=0x2d0) returned 0x1 [0072.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe5cc) returned 1 [0072.396] GetFileType (hFile=0x2d0) returned 0x1 [0072.396] WriteFile (in: hFile=0x2d0, lpBuffer=0x27e5c1c*, nNumberOfBytesToWrite=0x99d0, lpNumberOfBytesWritten=0x8fe680, lpOverlapped=0x0 | out: lpBuffer=0x27e5c1c*, lpNumberOfBytesWritten=0x8fe680*=0x99d0, lpOverlapped=0x0) returned 1 [0072.397] CloseHandle (hObject=0x2d0) returned 1 [0072.398] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx", lpFilePart=0x0) returned 0x69 [0072.398] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x94 [0072.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe668) returned 1 [0072.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\wftprdectil5_77rl.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fe6e4 | out: lpFileInformation=0x8fe6e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x667ae1a0, ftCreationTime.dwHighDateTime=0x1d62bc1, ftLastAccessTime.dwLowDateTime=0xd43b81f0, ftLastAccessTime.dwHighDateTime=0x1d62ee0, ftLastWriteTime.dwLowDateTime=0x8733c120, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x99d0)) returned 1 [0072.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe664) returned 1 [0072.398] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\wftprdectil5_77rl.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\wftPRDectil5_77rL.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\4kq5td-thepqj\\tw_xjgulej_6qr\\nbpy c\\wftprdectil5_77rl.xlsx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0072.399] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c", nBufferLength=0x105, lpBuffer=0x8fe194, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c", lpFilePart=0x0) returned 0x52 [0072.399] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\4kQ5Td-thEPQj\\Tw_XJguLeJ_6QR\\NbpY c\\*", lpFindFileData=0x8fe408 | out: lpFindFileData=0x8fe408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a749f80, ftCreationTime.dwHighDateTime=0x1d62bd1, ftLastAccessTime.dwLowDateTime=0x8733c120, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8733c120, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1248 [0072.400] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe414 | out: lpFindFileData=0x8fe414*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a749f80, ftCreationTime.dwHighDateTime=0x1d62bd1, ftLastAccessTime.dwLowDateTime=0x8733c120, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8733c120, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.400] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe414 | out: lpFindFileData=0x8fe414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72919a90, ftCreationTime.dwHighDateTime=0x1d623c6, ftLastAccessTime.dwLowDateTime=0xc0cb2b80, ftLastAccessTime.dwHighDateTime=0x1d632b8, ftLastWriteTime.dwLowDateTime=0x871bea62, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xbc20, dwReserved0=0x0, dwReserved1=0x0, cFileName="e Msl NH5-YXxZQG0.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EMSLNH~1.MAD")) returned 1 [0072.400] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe414 | out: lpFindFileData=0x8fe414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f5d8e50, ftCreationTime.dwHighDateTime=0x1d63094, ftLastAccessTime.dwLowDateTime=0x890d2710, ftLastAccessTime.dwHighDateTime=0x1d62481, ftLastWriteTime.dwLowDateTime=0x872a3fbf, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe610, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qi8Cq.odp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="QI8CQO~1.MAD")) returned 1 [0072.400] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe414 | out: lpFindFileData=0x8fe414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x667ae1a0, ftCreationTime.dwHighDateTime=0x1d62bc1, ftLastAccessTime.dwLowDateTime=0xd43b81f0, ftLastAccessTime.dwHighDateTime=0x1d62ee0, ftLastWriteTime.dwLowDateTime=0x8733c120, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x99d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wftPRDectil5_77rL.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="WFTPRD~1.MAD")) returned 1 [0072.400] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe414 | out: lpFindFileData=0x8fe414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x667ae1a0, ftCreationTime.dwHighDateTime=0x1d62bc1, ftLastAccessTime.dwLowDateTime=0xd43b81f0, ftLastAccessTime.dwHighDateTime=0x1d62ee0, ftLastWriteTime.dwLowDateTime=0x8733c120, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x99d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wftPRDectil5_77rL.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="WFTPRD~1.MAD")) returned 0 [0072.400] FindClose (in: hFindFile=0xac1248 | out: hFindFile=0xac1248) returned 1 [0072.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe69c) returned 1 [0072.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6a8) returned 1 [0072.400] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw", nBufferLength=0x105, lpBuffer=0x8fe250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw", lpFilePart=0x0) returned 0x3d [0072.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0072.400] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw", lpFilePart=0x0) returned 0x3d [0072.400] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b457760, ftCreationTime.dwHighDateTime=0x1d628b3, ftLastAccessTime.dwLowDateTime=0x6db34620, ftLastAccessTime.dwHighDateTime=0x1d62cb0, ftLastWriteTime.dwLowDateTime=0x6db34620, ftLastWriteTime.dwHighDateTime=0x1d62cb0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1008 [0072.401] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b457760, ftCreationTime.dwHighDateTime=0x1d628b3, ftLastAccessTime.dwLowDateTime=0x6db34620, ftLastAccessTime.dwHighDateTime=0x1d62cb0, ftLastWriteTime.dwLowDateTime=0x6db34620, ftLastWriteTime.dwHighDateTime=0x1d62cb0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.401] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58e0f2b0, ftCreationTime.dwHighDateTime=0x1d632cd, ftLastAccessTime.dwLowDateTime=0x845c9270, ftLastAccessTime.dwHighDateTime=0x1d62a83, ftLastWriteTime.dwLowDateTime=0x845c9270, ftLastWriteTime.dwHighDateTime=0x1d62a83, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DbACM8DMzwAwjfK", cAlternateFileName="DBACM8~1")) returned 1 [0072.401] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6d4560, ftCreationTime.dwHighDateTime=0x1d62ce5, ftLastAccessTime.dwLowDateTime=0x865ab970, ftLastAccessTime.dwHighDateTime=0x1d632f4, ftLastWriteTime.dwLowDateTime=0x865ab970, ftLastWriteTime.dwHighDateTime=0x1d632f4, nFileSizeHigh=0x0, nFileSizeLow=0x817b, dwReserved0=0x0, dwReserved1=0x0, cFileName="fjDVlov78AoNUPiw.doc", cAlternateFileName="FJDVLO~1.DOC")) returned 1 [0072.402] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.402] FindClose (in: hFindFile=0xac1008 | out: hFindFile=0xac1008) returned 1 [0072.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0072.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0072.402] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc", lpFilePart=0x0) returned 0x52 [0072.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0072.402] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\fjdvlov78aonupiw.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.402] GetFileType (hFile=0x2d0) returned 0x1 [0072.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0072.402] GetFileType (hFile=0x2d0) returned 0x1 [0072.402] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x817b [0072.402] ReadFile (in: hFile=0x2d0, lpBuffer=0x27f1d0c, nNumberOfBytesToRead=0x817b, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x27f1d0c*, lpNumberOfBytesRead=0x8fe718*=0x817b, lpOverlapped=0x0) returned 1 [0072.402] CloseHandle (hObject=0x2d0) returned 1 [0072.418] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc", lpFilePart=0x0) returned 0x52 [0072.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0072.418] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\fjdvlov78aonupiw.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.419] GetFileType (hFile=0x2d0) returned 0x1 [0072.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0072.419] GetFileType (hFile=0x2d0) returned 0x1 [0072.419] WriteFile (in: hFile=0x2d0, lpBuffer=0x2867290*, nNumberOfBytesToWrite=0x8180, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x2867290*, lpNumberOfBytesWritten=0x8fe708*=0x8180, lpOverlapped=0x0) returned 1 [0072.420] CloseHandle (hObject=0x2d0) returned 1 [0072.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc", lpFilePart=0x0) returned 0x52 [0072.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x7d [0072.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0072.422] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\fjdvlov78aonupiw.doc"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6d4560, ftCreationTime.dwHighDateTime=0x1d62ce5, ftLastAccessTime.dwLowDateTime=0x865ab970, ftLastAccessTime.dwHighDateTime=0x1d632f4, ftLastWriteTime.dwLowDateTime=0x873885f2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8180)) returned 1 [0072.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0072.422] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\fjdvlov78aonupiw.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\fjDVlov78AoNUPiw.doc.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\fjdvlov78aonupiw.doc.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0072.468] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw", lpFilePart=0x0) returned 0x3d [0072.468] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b457760, ftCreationTime.dwHighDateTime=0x1d628b3, ftLastAccessTime.dwLowDateTime=0x873fad7a, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x873fad7a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1188 [0072.468] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b457760, ftCreationTime.dwHighDateTime=0x1d628b3, ftLastAccessTime.dwLowDateTime=0x873fad7a, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x873fad7a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.468] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58e0f2b0, ftCreationTime.dwHighDateTime=0x1d632cd, ftLastAccessTime.dwLowDateTime=0x845c9270, ftLastAccessTime.dwHighDateTime=0x1d62a83, ftLastWriteTime.dwLowDateTime=0x845c9270, ftLastWriteTime.dwHighDateTime=0x1d62a83, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DbACM8DMzwAwjfK", cAlternateFileName="DBACM8~1")) returned 1 [0072.469] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6d4560, ftCreationTime.dwHighDateTime=0x1d62ce5, ftLastAccessTime.dwLowDateTime=0x865ab970, ftLastAccessTime.dwHighDateTime=0x1d632f4, ftLastWriteTime.dwLowDateTime=0x873885f2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8180, dwReserved0=0x0, dwReserved1=0x0, cFileName="fjDVlov78AoNUPiw.doc.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="FJDVLO~1.MAD")) returned 1 [0072.469] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6d4560, ftCreationTime.dwHighDateTime=0x1d62ce5, ftLastAccessTime.dwLowDateTime=0x865ab970, ftLastAccessTime.dwHighDateTime=0x1d632f4, ftLastWriteTime.dwLowDateTime=0x873885f2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8180, dwReserved0=0x0, dwReserved1=0x0, cFileName="fjDVlov78AoNUPiw.doc.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="FJDVLO~1.MAD")) returned 0 [0072.469] FindClose (in: hFindFile=0xac1188 | out: hFindFile=0xac1188) returned 1 [0072.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0072.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0072.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK", nBufferLength=0x105, lpBuffer=0x8fe20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK", lpFilePart=0x0) returned 0x4d [0072.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0072.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK", nBufferLength=0x105, lpBuffer=0x8fe1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK", lpFilePart=0x0) returned 0x4d [0072.469] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\*", lpFindFileData=0x8fe44c | out: lpFindFileData=0x8fe44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58e0f2b0, ftCreationTime.dwHighDateTime=0x1d632cd, ftLastAccessTime.dwLowDateTime=0x845c9270, ftLastAccessTime.dwHighDateTime=0x1d62a83, ftLastWriteTime.dwLowDateTime=0x845c9270, ftLastWriteTime.dwHighDateTime=0x1d62a83, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0072.469] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58e0f2b0, ftCreationTime.dwHighDateTime=0x1d632cd, ftLastAccessTime.dwLowDateTime=0x845c9270, ftLastAccessTime.dwHighDateTime=0x1d62a83, ftLastWriteTime.dwLowDateTime=0x845c9270, ftLastWriteTime.dwHighDateTime=0x1d62a83, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.469] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c71180, ftCreationTime.dwHighDateTime=0x1d6306e, ftLastAccessTime.dwLowDateTime=0x4a2b8350, ftLastAccessTime.dwHighDateTime=0x1d6279e, ftLastWriteTime.dwLowDateTime=0x4a2b8350, ftLastWriteTime.dwHighDateTime=0x1d6279e, nFileSizeHigh=0x0, nFileSizeLow=0x250e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0djHxjyGTMRjNGaUYY.xlsx", cAlternateFileName="0DJHXJ~1.XLS")) returned 1 [0072.470] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38a65220, ftCreationTime.dwHighDateTime=0x1d62633, ftLastAccessTime.dwLowDateTime=0x25e7b910, ftLastAccessTime.dwHighDateTime=0x1d625e5, ftLastWriteTime.dwLowDateTime=0x25e7b910, ftLastWriteTime.dwHighDateTime=0x1d625e5, nFileSizeHigh=0x0, nFileSizeLow=0x667f, dwReserved0=0x0, dwReserved1=0x0, cFileName="mtkW0QtwH PZjt.pptx", cAlternateFileName="MTKW0Q~1.PPT")) returned 1 [0072.470] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb9782a0, ftCreationTime.dwHighDateTime=0x1d63151, ftLastAccessTime.dwLowDateTime=0xb53d3660, ftLastAccessTime.dwHighDateTime=0x1d63046, ftLastWriteTime.dwLowDateTime=0xb53d3660, ftLastWriteTime.dwHighDateTime=0x1d63046, nFileSizeHigh=0x0, nFileSizeLow=0x11f21, dwReserved0=0x0, dwReserved1=0x0, cFileName="sgD99NGjNGlrQ5HZB9.doc", cAlternateFileName="SGD99N~1.DOC")) returned 1 [0072.470] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112040, ftCreationTime.dwHighDateTime=0x1d62a4b, ftLastAccessTime.dwLowDateTime=0xb510d570, ftLastAccessTime.dwHighDateTime=0x1d62812, ftLastWriteTime.dwLowDateTime=0xb510d570, ftLastWriteTime.dwHighDateTime=0x1d62812, nFileSizeHigh=0x0, nFileSizeLow=0x11a23, dwReserved0=0x0, dwReserved1=0x0, cFileName="uOVIGwoQNPvyQPM.pps", cAlternateFileName="UOVIGW~1.PPS")) returned 1 [0072.470] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.470] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0072.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6e0) returned 1 [0072.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0072.470] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx", nBufferLength=0x105, lpBuffer=0x8fe0e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx", lpFilePart=0x0) returned 0x65 [0072.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe62c) returned 1 [0072.470] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\0djhxjygtmrjngauyy.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.470] GetFileType (hFile=0x2d0) returned 0x1 [0072.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe628) returned 1 [0072.470] GetFileType (hFile=0x2d0) returned 0x1 [0072.470] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe728 | out: lpFileSizeHigh=0x8fe728*=0x0) returned 0x250e [0072.470] ReadFile (in: hFile=0x2d0, lpBuffer=0x2871df0, nNumberOfBytesToRead=0x250e, lpNumberOfBytesRead=0x8fe6d4, lpOverlapped=0x0 | out: lpBuffer=0x2871df0*, lpNumberOfBytesRead=0x8fe6d4*=0x250e, lpOverlapped=0x0) returned 1 [0072.470] CloseHandle (hObject=0x2d0) returned 1 [0072.486] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx", nBufferLength=0x105, lpBuffer=0x8fe0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx", lpFilePart=0x0) returned 0x65 [0072.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe614) returned 1 [0072.486] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\0djhxjygtmrjngauyy.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.487] GetFileType (hFile=0x2d0) returned 0x1 [0072.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe610) returned 1 [0072.487] GetFileType (hFile=0x2d0) returned 0x1 [0072.487] WriteFile (in: hFile=0x2d0, lpBuffer=0x28ca544*, nNumberOfBytesToWrite=0x2510, lpNumberOfBytesWritten=0x8fe6c4, lpOverlapped=0x0 | out: lpBuffer=0x28ca544*, lpNumberOfBytesWritten=0x8fe6c4*=0x2510, lpOverlapped=0x0) returned 1 [0072.488] CloseHandle (hObject=0x2d0) returned 1 [0072.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx", lpFilePart=0x0) returned 0x65 [0072.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x90 [0072.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6ac) returned 1 [0072.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\0djhxjygtmrjngauyy.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fe728 | out: lpFileInformation=0x8fe728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c71180, ftCreationTime.dwHighDateTime=0x1d6306e, ftLastAccessTime.dwLowDateTime=0x4a2b8350, ftLastAccessTime.dwHighDateTime=0x1d6279e, ftLastWriteTime.dwLowDateTime=0x87420fa3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2510)) returned 1 [0072.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6a8) returned 1 [0072.489] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\0djhxjygtmrjngauyy.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\0djHxjyGTMRjNGaUYY.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\0djhxjygtmrjngauyy.xlsx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx", nBufferLength=0x105, lpBuffer=0x8fe0e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx", lpFilePart=0x0) returned 0x61 [0072.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe62c) returned 1 [0072.490] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\mtkw0qtwh pzjt.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.490] GetFileType (hFile=0x2d0) returned 0x1 [0072.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe628) returned 1 [0072.490] GetFileType (hFile=0x2d0) returned 0x1 [0072.490] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe728 | out: lpFileSizeHigh=0x8fe728*=0x0) returned 0x667f [0072.490] ReadFile (in: hFile=0x2d0, lpBuffer=0x28cd0c0, nNumberOfBytesToRead=0x667f, lpNumberOfBytesRead=0x8fe6d4, lpOverlapped=0x0 | out: lpBuffer=0x28cd0c0*, lpNumberOfBytesRead=0x8fe6d4*=0x667f, lpOverlapped=0x0) returned 1 [0072.490] CloseHandle (hObject=0x2d0) returned 1 [0072.554] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx", nBufferLength=0x105, lpBuffer=0x8fe0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx", lpFilePart=0x0) returned 0x61 [0072.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe614) returned 1 [0072.554] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\mtkw0qtwh pzjt.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.555] GetFileType (hFile=0x2d0) returned 0x1 [0072.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe610) returned 1 [0072.555] GetFileType (hFile=0x2d0) returned 0x1 [0072.555] WriteFile (in: hFile=0x2d0, lpBuffer=0x273202c*, nNumberOfBytesToWrite=0x6680, lpNumberOfBytesWritten=0x8fe6c4, lpOverlapped=0x0 | out: lpBuffer=0x273202c*, lpNumberOfBytesWritten=0x8fe6c4*=0x6680, lpOverlapped=0x0) returned 1 [0072.556] CloseHandle (hObject=0x2d0) returned 1 [0072.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx", lpFilePart=0x0) returned 0x61 [0072.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x8c [0072.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6ac) returned 1 [0072.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\mtkw0qtwh pzjt.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fe728 | out: lpFileInformation=0x8fe728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38a65220, ftCreationTime.dwHighDateTime=0x1d62633, ftLastAccessTime.dwLowDateTime=0x25e7b910, ftLastAccessTime.dwHighDateTime=0x1d625e5, ftLastWriteTime.dwLowDateTime=0x874b98d5, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x6680)) returned 1 [0072.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6a8) returned 1 [0072.557] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\mtkw0qtwh pzjt.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\mtkW0QtwH PZjt.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\mtkw0qtwh pzjt.pptx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.558] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc", nBufferLength=0x105, lpBuffer=0x8fe0e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc", lpFilePart=0x0) returned 0x64 [0072.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe62c) returned 1 [0072.558] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\sgd99ngjnglrq5hzb9.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.558] GetFileType (hFile=0x2d0) returned 0x1 [0072.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe628) returned 1 [0072.558] GetFileType (hFile=0x2d0) returned 0x1 [0072.558] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe728 | out: lpFileSizeHigh=0x8fe728*=0x0) returned 0x11f21 [0072.558] ReadFile (in: hFile=0x2d0, lpBuffer=0x2738d00, nNumberOfBytesToRead=0x11f21, lpNumberOfBytesRead=0x8fe6d4, lpOverlapped=0x0 | out: lpBuffer=0x2738d00*, lpNumberOfBytesRead=0x8fe6d4*=0x11f21, lpOverlapped=0x0) returned 1 [0072.559] CloseHandle (hObject=0x2d0) returned 1 [0072.584] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc", nBufferLength=0x105, lpBuffer=0x8fe0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc", lpFilePart=0x0) returned 0x64 [0072.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe614) returned 1 [0072.584] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\sgd99ngjnglrq5hzb9.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.585] GetFileType (hFile=0x2d0) returned 0x1 [0072.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe610) returned 1 [0072.585] GetFileType (hFile=0x2d0) returned 0x1 [0072.585] WriteFile (in: hFile=0x2d0, lpBuffer=0x27bba04*, nNumberOfBytesToWrite=0x11f30, lpNumberOfBytesWritten=0x8fe6c4, lpOverlapped=0x0 | out: lpBuffer=0x27bba04*, lpNumberOfBytesWritten=0x8fe6c4*=0x11f30, lpOverlapped=0x0) returned 1 [0072.587] CloseHandle (hObject=0x2d0) returned 1 [0072.680] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc", lpFilePart=0x0) returned 0x64 [0072.680] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x8f [0072.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6ac) returned 1 [0072.680] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\sgd99ngjnglrq5hzb9.doc"), fInfoLevelId=0x0, lpFileInformation=0x8fe728 | out: lpFileInformation=0x8fe728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb9782a0, ftCreationTime.dwHighDateTime=0x1d63151, ftLastAccessTime.dwLowDateTime=0xb53d3660, ftLastAccessTime.dwHighDateTime=0x1d63046, ftLastWriteTime.dwLowDateTime=0x875eac30, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11f30)) returned 1 [0072.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6a8) returned 1 [0072.680] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\sgd99ngjnglrq5hzb9.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\sgD99NGjNGlrQ5HZB9.doc.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\hqgrfyq nefyiqdfnai1\\gu0udovg-p5izw\\dbacm8dmzwawjfk\\sgd99ngjnglrq5hzb9.doc.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0072.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK", nBufferLength=0x105, lpBuffer=0x8fe1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK", lpFilePart=0x0) returned 0x4d [0072.681] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hQgrfyQ NeFYiQdFnAI1\\gu0uDOvG-P5Izw\\DbACM8DMzwAwjfK\\*", lpFindFileData=0x8fe44c | out: lpFindFileData=0x8fe44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58e0f2b0, ftCreationTime.dwHighDateTime=0x1d632cd, ftLastAccessTime.dwLowDateTime=0x875eac30, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x875eac30, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0072.681] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58e0f2b0, ftCreationTime.dwHighDateTime=0x1d632cd, ftLastAccessTime.dwLowDateTime=0x875eac30, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x875eac30, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.681] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c71180, ftCreationTime.dwHighDateTime=0x1d6306e, ftLastAccessTime.dwLowDateTime=0x4a2b8350, ftLastAccessTime.dwHighDateTime=0x1d6279e, ftLastWriteTime.dwLowDateTime=0x87420fa3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2510, dwReserved0=0x0, dwReserved1=0x0, cFileName="0djHxjyGTMRjNGaUYY.xlsx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="0DJHXJ~1.MAD")) returned 1 [0072.681] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38a65220, ftCreationTime.dwHighDateTime=0x1d62633, ftLastAccessTime.dwLowDateTime=0x25e7b910, ftLastAccessTime.dwHighDateTime=0x1d625e5, ftLastWriteTime.dwLowDateTime=0x874b98d5, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x6680, dwReserved0=0x0, dwReserved1=0x0, cFileName="mtkW0QtwH PZjt.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="MTKW0Q~1.MAD")) returned 1 [0072.682] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb9782a0, ftCreationTime.dwHighDateTime=0x1d63151, ftLastAccessTime.dwLowDateTime=0xb53d3660, ftLastAccessTime.dwHighDateTime=0x1d63046, ftLastWriteTime.dwLowDateTime=0x875eac30, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11f30, dwReserved0=0x0, dwReserved1=0x0, cFileName="sgD99NGjNGlrQ5HZB9.doc.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="SGD99N~1.MAD")) returned 1 [0072.682] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112040, ftCreationTime.dwHighDateTime=0x1d62a4b, ftLastAccessTime.dwLowDateTime=0xb510d570, ftLastAccessTime.dwHighDateTime=0x1d62812, ftLastWriteTime.dwLowDateTime=0xb510d570, ftLastWriteTime.dwHighDateTime=0x1d62812, nFileSizeHigh=0x0, nFileSizeLow=0x11a23, dwReserved0=0x0, dwReserved1=0x0, cFileName="uOVIGwoQNPvyQPM.pps", cAlternateFileName="UOVIGW~1.PPS")) returned 1 [0072.682] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112040, ftCreationTime.dwHighDateTime=0x1d62a4b, ftLastAccessTime.dwLowDateTime=0xb510d570, ftLastAccessTime.dwHighDateTime=0x1d62812, ftLastWriteTime.dwLowDateTime=0xb510d570, ftLastWriteTime.dwHighDateTime=0x1d62812, nFileSizeHigh=0x0, nFileSizeLow=0x11a23, dwReserved0=0x0, dwReserved1=0x0, cFileName="uOVIGwoQNPvyQPM.pps", cAlternateFileName="UOVIGW~1.PPS")) returned 0 [0072.682] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0072.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6e0) returned 1 [0072.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0072.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0072.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0072.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0072.682] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0072.682] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.683] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0072.683] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.683] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0072.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0072.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0072.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0072.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0072.683] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1408 [0072.683] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.683] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0072.683] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0072.684] FindClose (in: hFindFile=0xac1408 | out: hFindFile=0xac1408) returned 1 [0072.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0072.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0072.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog", lpFilePart=0x0) returned 0x2a [0072.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0072.684] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog", lpFilePart=0x0) returned 0x2a [0072.684] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d09a7b0, ftCreationTime.dwHighDateTime=0x1d62bbc, ftLastAccessTime.dwLowDateTime=0xd0807190, ftLastAccessTime.dwHighDateTime=0x1d62c76, ftLastWriteTime.dwLowDateTime=0xd0807190, ftLastWriteTime.dwHighDateTime=0x1d62c76, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0072.684] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d09a7b0, ftCreationTime.dwHighDateTime=0x1d62bbc, ftLastAccessTime.dwLowDateTime=0xd0807190, ftLastAccessTime.dwHighDateTime=0x1d62c76, ftLastWriteTime.dwLowDateTime=0xd0807190, ftLastWriteTime.dwHighDateTime=0x1d62c76, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.684] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x135c9ff0, ftCreationTime.dwHighDateTime=0x1d63278, ftLastAccessTime.dwLowDateTime=0xefe50ac0, ftLastAccessTime.dwHighDateTime=0x1d62878, ftLastWriteTime.dwLowDateTime=0xefe50ac0, ftLastWriteTime.dwHighDateTime=0x1d62878, nFileSizeHigh=0x0, nFileSizeLow=0x4263, dwReserved0=0x0, dwReserved1=0x0, cFileName="0SDAGs.ppt", cAlternateFileName="")) returned 1 [0072.684] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa01d9a0, ftCreationTime.dwHighDateTime=0x1d6303b, ftLastAccessTime.dwLowDateTime=0x56d746d0, ftLastAccessTime.dwHighDateTime=0x1d62897, ftLastWriteTime.dwLowDateTime=0x56d746d0, ftLastWriteTime.dwHighDateTime=0x1d62897, nFileSizeHigh=0x0, nFileSizeLow=0xa38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-mkfCh_879uji.pdf", cAlternateFileName="8-MKFC~1.PDF")) returned 1 [0072.684] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dde8bc0, ftCreationTime.dwHighDateTime=0x1d6254b, ftLastAccessTime.dwLowDateTime=0xbb23d270, ftLastAccessTime.dwHighDateTime=0x1d62540, ftLastWriteTime.dwLowDateTime=0xbb23d270, ftLastWriteTime.dwHighDateTime=0x1d62540, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="w X0", cAlternateFileName="WX0~1")) returned 1 [0072.684] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dde8bc0, ftCreationTime.dwHighDateTime=0x1d6254b, ftLastAccessTime.dwLowDateTime=0xbb23d270, ftLastAccessTime.dwHighDateTime=0x1d62540, ftLastWriteTime.dwLowDateTime=0xbb23d270, ftLastWriteTime.dwHighDateTime=0x1d62540, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="w X0", cAlternateFileName="WX0~1")) returned 0 [0072.685] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0072.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0072.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0072.685] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt", lpFilePart=0x0) returned 0x35 [0072.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0072.685] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\0sdags.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.685] GetFileType (hFile=0x2d0) returned 0x1 [0072.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0072.685] GetFileType (hFile=0x2d0) returned 0x1 [0072.685] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x4263 [0072.685] ReadFile (in: hFile=0x2d0, lpBuffer=0x27d1180, nNumberOfBytesToRead=0x4263, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x27d1180*, lpNumberOfBytesRead=0x8fe75c*=0x4263, lpOverlapped=0x0) returned 1 [0072.685] CloseHandle (hObject=0x2d0) returned 1 [0072.705] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt", lpFilePart=0x0) returned 0x35 [0072.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0072.705] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\0sdags.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.706] GetFileType (hFile=0x2d0) returned 0x1 [0072.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0072.706] GetFileType (hFile=0x2d0) returned 0x1 [0072.706] WriteFile (in: hFile=0x2d0, lpBuffer=0x2832bb4*, nNumberOfBytesToWrite=0x4270, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2832bb4*, lpNumberOfBytesWritten=0x8fe74c*=0x4270, lpOverlapped=0x0) returned 1 [0072.707] CloseHandle (hObject=0x2d0) returned 1 [0072.708] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt", lpFilePart=0x0) returned 0x35 [0072.708] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x60 [0072.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0072.708] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\0sdags.ppt"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x135c9ff0, ftCreationTime.dwHighDateTime=0x1d63278, ftLastAccessTime.dwLowDateTime=0xefe50ac0, ftLastAccessTime.dwHighDateTime=0x1d62878, ftLastWriteTime.dwLowDateTime=0x876372b2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4270)) returned 1 [0072.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0072.709] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\0sdags.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\0SDAGs.ppt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\0sdags.ppt.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0072.709] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog", lpFilePart=0x0) returned 0x2a [0072.709] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d09a7b0, ftCreationTime.dwHighDateTime=0x1d62bbc, ftLastAccessTime.dwLowDateTime=0x876372b2, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x876372b2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1408 [0072.710] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d09a7b0, ftCreationTime.dwHighDateTime=0x1d62bbc, ftLastAccessTime.dwLowDateTime=0x876372b2, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x876372b2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.710] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x135c9ff0, ftCreationTime.dwHighDateTime=0x1d63278, ftLastAccessTime.dwLowDateTime=0xefe50ac0, ftLastAccessTime.dwHighDateTime=0x1d62878, ftLastWriteTime.dwLowDateTime=0x876372b2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4270, dwReserved0=0x0, dwReserved1=0x0, cFileName="0SDAGs.ppt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="0SDAGS~1.MAD")) returned 1 [0072.710] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa01d9a0, ftCreationTime.dwHighDateTime=0x1d6303b, ftLastAccessTime.dwLowDateTime=0x56d746d0, ftLastAccessTime.dwHighDateTime=0x1d62897, ftLastWriteTime.dwLowDateTime=0x56d746d0, ftLastWriteTime.dwHighDateTime=0x1d62897, nFileSizeHigh=0x0, nFileSizeLow=0xa38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-mkfCh_879uji.pdf", cAlternateFileName="8-MKFC~1.PDF")) returned 1 [0072.710] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dde8bc0, ftCreationTime.dwHighDateTime=0x1d6254b, ftLastAccessTime.dwLowDateTime=0xbb23d270, ftLastAccessTime.dwHighDateTime=0x1d62540, ftLastWriteTime.dwLowDateTime=0xbb23d270, ftLastWriteTime.dwHighDateTime=0x1d62540, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="w X0", cAlternateFileName="WX0~1")) returned 1 [0072.710] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.710] FindClose (in: hFindFile=0xac1408 | out: hFindFile=0xac1408) returned 1 [0072.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0072.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0072.710] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0", nBufferLength=0x105, lpBuffer=0x8fe250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0", lpFilePart=0x0) returned 0x2f [0072.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0072.710] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0", lpFilePart=0x0) returned 0x2f [0072.710] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dde8bc0, ftCreationTime.dwHighDateTime=0x1d6254b, ftLastAccessTime.dwLowDateTime=0xbb23d270, ftLastAccessTime.dwHighDateTime=0x1d62540, ftLastWriteTime.dwLowDateTime=0xbb23d270, ftLastWriteTime.dwHighDateTime=0x1d62540, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1408 [0072.711] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dde8bc0, ftCreationTime.dwHighDateTime=0x1d6254b, ftLastAccessTime.dwLowDateTime=0xbb23d270, ftLastAccessTime.dwHighDateTime=0x1d62540, ftLastWriteTime.dwLowDateTime=0xbb23d270, ftLastWriteTime.dwHighDateTime=0x1d62540, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.711] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2113f840, ftCreationTime.dwHighDateTime=0x1d62ce8, ftLastAccessTime.dwLowDateTime=0x37d1ce20, ftLastAccessTime.dwHighDateTime=0x1d62ec5, ftLastWriteTime.dwLowDateTime=0x37d1ce20, ftLastWriteTime.dwHighDateTime=0x1d62ec5, nFileSizeHigh=0x0, nFileSizeLow=0x5f0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="btL5rc05.pptx", cAlternateFileName="BTL5RC~1.PPT")) returned 1 [0072.711] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74be7e0, ftCreationTime.dwHighDateTime=0x1d62545, ftLastAccessTime.dwLowDateTime=0x2caa8dc0, ftLastAccessTime.dwHighDateTime=0x1d62637, ftLastWriteTime.dwLowDateTime=0x2caa8dc0, ftLastWriteTime.dwHighDateTime=0x1d62637, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x0, dwReserved1=0x0, cFileName="mE4RsrOZ7AAOEZp1.ots", cAlternateFileName="ME4RSR~1.OTS")) returned 1 [0072.711] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d872390, ftCreationTime.dwHighDateTime=0x1d628ac, ftLastAccessTime.dwLowDateTime=0xf23dc140, ftLastAccessTime.dwHighDateTime=0x1d62abc, ftLastWriteTime.dwLowDateTime=0xf23dc140, ftLastWriteTime.dwHighDateTime=0x1d62abc, nFileSizeHigh=0x0, nFileSizeLow=0xdf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="OHOeiILDCM8xSWCx1.rtf", cAlternateFileName="OHOEII~1.RTF")) returned 1 [0072.711] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211e1740, ftCreationTime.dwHighDateTime=0x1d62de1, ftLastAccessTime.dwLowDateTime=0x1e9e14c0, ftLastAccessTime.dwHighDateTime=0x1d630a2, ftLastWriteTime.dwLowDateTime=0x1e9e14c0, ftLastWriteTime.dwHighDateTime=0x1d630a2, nFileSizeHigh=0x0, nFileSizeLow=0xe2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="pf6xj gMVgA52VJ.ots", cAlternateFileName="PF6XJG~1.OTS")) returned 1 [0072.711] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eec07c0, ftCreationTime.dwHighDateTime=0x1d62942, ftLastAccessTime.dwLowDateTime=0x7d5925e0, ftLastAccessTime.dwHighDateTime=0x1d628be, ftLastWriteTime.dwLowDateTime=0x7d5925e0, ftLastWriteTime.dwHighDateTime=0x1d628be, nFileSizeHigh=0x0, nFileSizeLow=0x893c, dwReserved0=0x0, dwReserved1=0x0, cFileName="vRbFPDGjNPktZYIGb.xls", cAlternateFileName="VRBFPD~1.XLS")) returned 1 [0072.711] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b01c2f0, ftCreationTime.dwHighDateTime=0x1d62b92, ftLastAccessTime.dwLowDateTime=0x339ef7d0, ftLastAccessTime.dwHighDateTime=0x1d6236a, ftLastWriteTime.dwLowDateTime=0x339ef7d0, ftLastWriteTime.dwHighDateTime=0x1d6236a, nFileSizeHigh=0x0, nFileSizeLow=0x4ff4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZEgUTL.xls", cAlternateFileName="")) returned 1 [0072.711] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.711] FindClose (in: hFindFile=0xac1408 | out: hFindFile=0xac1408) returned 1 [0072.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0072.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0072.712] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx", lpFilePart=0x0) returned 0x3d [0072.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0072.712] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\btl5rc05.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.712] GetFileType (hFile=0x2d0) returned 0x1 [0072.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0072.712] GetFileType (hFile=0x2d0) returned 0x1 [0072.712] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x5f0f [0072.712] ReadFile (in: hFile=0x2d0, lpBuffer=0x28393ec, nNumberOfBytesToRead=0x5f0f, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x28393ec*, lpNumberOfBytesRead=0x8fe718*=0x5f0f, lpOverlapped=0x0) returned 1 [0072.712] CloseHandle (hObject=0x2d0) returned 1 [0072.787] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx", lpFilePart=0x0) returned 0x3d [0072.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0072.787] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\btl5rc05.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.788] GetFileType (hFile=0x2d0) returned 0x1 [0072.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0072.788] GetFileType (hFile=0x2d0) returned 0x1 [0072.788] WriteFile (in: hFile=0x2d0, lpBuffer=0x28a3d40*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x28a3d40*, lpNumberOfBytesWritten=0x8fe708*=0x5f10, lpOverlapped=0x0) returned 1 [0072.789] CloseHandle (hObject=0x2d0) returned 1 [0072.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx", lpFilePart=0x0) returned 0x3d [0072.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x68 [0072.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0072.790] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\btl5rc05.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2113f840, ftCreationTime.dwHighDateTime=0x1d62ce8, ftLastAccessTime.dwLowDateTime=0x37d1ce20, ftLastAccessTime.dwHighDateTime=0x1d62ec5, ftLastWriteTime.dwLowDateTime=0x876f86bd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5f10)) returned 1 [0072.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0072.790] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\btl5rc05.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\btL5rc05.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\btl5rc05.pptx.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.791] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf", lpFilePart=0x0) returned 0x45 [0072.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0072.791] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\ohoeiildcm8xswcx1.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.791] GetFileType (hFile=0x2d0) returned 0x1 [0072.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0072.791] GetFileType (hFile=0x2d0) returned 0x1 [0072.791] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0xdf38 [0072.791] ReadFile (in: hFile=0x2d0, lpBuffer=0x28aa14c, nNumberOfBytesToRead=0xdf38, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x28aa14c*, lpNumberOfBytesRead=0x8fe718*=0xdf38, lpOverlapped=0x0) returned 1 [0072.791] CloseHandle (hObject=0x2d0) returned 1 [0072.864] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf", lpFilePart=0x0) returned 0x45 [0072.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0072.865] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\ohoeiildcm8xswcx1.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.866] GetFileType (hFile=0x2d0) returned 0x1 [0072.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0072.866] GetFileType (hFile=0x2d0) returned 0x1 [0072.866] WriteFile (in: hFile=0x2d0, lpBuffer=0x2710558*, nNumberOfBytesToWrite=0xdf40, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x2710558*, lpNumberOfBytesWritten=0x8fe708*=0xdf40, lpOverlapped=0x0) returned 1 [0072.867] CloseHandle (hObject=0x2d0) returned 1 [0072.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf", lpFilePart=0x0) returned 0x45 [0072.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x70 [0072.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0072.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\ohoeiildcm8xswcx1.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d872390, ftCreationTime.dwHighDateTime=0x1d628ac, ftLastAccessTime.dwLowDateTime=0xf23dc140, ftLastAccessTime.dwHighDateTime=0x1d62abc, ftLastWriteTime.dwLowDateTime=0x877b71e8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xdf40)) returned 1 [0072.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0072.869] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\ohoeiildcm8xswcx1.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\OHOeiILDCM8xSWCx1.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\ohoeiildcm8xswcx1.rtf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.869] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls", lpFilePart=0x0) returned 0x45 [0072.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0072.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\vrbfpdgjnpktzyigb.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.869] GetFileType (hFile=0x2d0) returned 0x1 [0072.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0072.869] GetFileType (hFile=0x2d0) returned 0x1 [0072.869] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x893c [0072.870] ReadFile (in: hFile=0x2d0, lpBuffer=0x271e9e4, nNumberOfBytesToRead=0x893c, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x271e9e4*, lpNumberOfBytesRead=0x8fe718*=0x893c, lpOverlapped=0x0) returned 1 [0072.870] CloseHandle (hObject=0x2d0) returned 1 [0072.953] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls", lpFilePart=0x0) returned 0x45 [0072.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0072.953] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\vrbfpdgjnpktzyigb.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.954] GetFileType (hFile=0x2d0) returned 0x1 [0072.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0072.954] GetFileType (hFile=0x2d0) returned 0x1 [0072.954] WriteFile (in: hFile=0x2d0, lpBuffer=0x2796780*, nNumberOfBytesToWrite=0x8940, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x2796780*, lpNumberOfBytesWritten=0x8fe708*=0x8940, lpOverlapped=0x0) returned 1 [0072.955] CloseHandle (hObject=0x2d0) returned 1 [0072.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls", lpFilePart=0x0) returned 0x45 [0072.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x70 [0072.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0072.957] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\vrbfpdgjnpktzyigb.xls"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eec07c0, ftCreationTime.dwHighDateTime=0x1d62942, ftLastAccessTime.dwLowDateTime=0x7d5925e0, ftLastAccessTime.dwHighDateTime=0x1d628be, ftLastWriteTime.dwLowDateTime=0x878aa496, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8940)) returned 1 [0072.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0072.957] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\vrbfpdgjnpktzyigb.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\vRbFPDGjNPktZYIGb.xls.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\vrbfpdgjnpktzyigb.xls.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls", lpFilePart=0x0) returned 0x3a [0072.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0072.957] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\zegutl.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.958] GetFileType (hFile=0x2d0) returned 0x1 [0072.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0072.958] GetFileType (hFile=0x2d0) returned 0x1 [0072.958] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x4ff4 [0072.958] ReadFile (in: hFile=0x2d0, lpBuffer=0x279f5cc, nNumberOfBytesToRead=0x4ff4, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x279f5cc*, lpNumberOfBytesRead=0x8fe718*=0x4ff4, lpOverlapped=0x0) returned 1 [0072.958] CloseHandle (hObject=0x2d0) returned 1 [0072.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls", lpFilePart=0x0) returned 0x3a [0072.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0072.975] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\zegutl.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0072.976] GetFileType (hFile=0x2d0) returned 0x1 [0072.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0072.976] GetFileType (hFile=0x2d0) returned 0x1 [0072.976] WriteFile (in: hFile=0x2d0, lpBuffer=0x28053cc*, nNumberOfBytesToWrite=0x5000, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x28053cc*, lpNumberOfBytesWritten=0x8fe708*=0x5000, lpOverlapped=0x0) returned 1 [0072.977] CloseHandle (hObject=0x2d0) returned 1 [0072.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls", lpFilePart=0x0) returned 0x3a [0072.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x65 [0072.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0072.978] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\zegutl.xls"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b01c2f0, ftCreationTime.dwHighDateTime=0x1d62b92, ftLastAccessTime.dwLowDateTime=0x339ef7d0, ftLastAccessTime.dwHighDateTime=0x1d6236a, ftLastWriteTime.dwLowDateTime=0x878d08fa, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5000)) returned 1 [0072.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0072.979] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\zegutl.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\ZEgUTL.xls.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\documents\\xcznpumghqq-fyog\\w x0\\zegutl.xls.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0072.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0072.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0", lpFilePart=0x0) returned 0x2f [0072.979] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\xCZNPuMghQq-fyog\\w X0\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dde8bc0, ftCreationTime.dwHighDateTime=0x1d6254b, ftLastAccessTime.dwLowDateTime=0x878d08fa, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x878d08fa, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1548 [0072.980] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dde8bc0, ftCreationTime.dwHighDateTime=0x1d6254b, ftLastAccessTime.dwLowDateTime=0x878d08fa, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x878d08fa, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.980] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2113f840, ftCreationTime.dwHighDateTime=0x1d62ce8, ftLastAccessTime.dwLowDateTime=0x37d1ce20, ftLastAccessTime.dwHighDateTime=0x1d62ec5, ftLastWriteTime.dwLowDateTime=0x876f86bd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="btL5rc05.pptx.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="BTL5RC~1.MAD")) returned 1 [0072.980] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74be7e0, ftCreationTime.dwHighDateTime=0x1d62545, ftLastAccessTime.dwLowDateTime=0x2caa8dc0, ftLastAccessTime.dwHighDateTime=0x1d62637, ftLastWriteTime.dwLowDateTime=0x2caa8dc0, ftLastWriteTime.dwHighDateTime=0x1d62637, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x0, dwReserved1=0x0, cFileName="mE4RsrOZ7AAOEZp1.ots", cAlternateFileName="ME4RSR~1.OTS")) returned 1 [0072.980] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d872390, ftCreationTime.dwHighDateTime=0x1d628ac, ftLastAccessTime.dwLowDateTime=0xf23dc140, ftLastAccessTime.dwHighDateTime=0x1d62abc, ftLastWriteTime.dwLowDateTime=0x877b71e8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xdf40, dwReserved0=0x0, dwReserved1=0x0, cFileName="OHOeiILDCM8xSWCx1.rtf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="OHOEII~1.MAD")) returned 1 [0072.980] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211e1740, ftCreationTime.dwHighDateTime=0x1d62de1, ftLastAccessTime.dwLowDateTime=0x1e9e14c0, ftLastAccessTime.dwHighDateTime=0x1d630a2, ftLastWriteTime.dwLowDateTime=0x1e9e14c0, ftLastWriteTime.dwHighDateTime=0x1d630a2, nFileSizeHigh=0x0, nFileSizeLow=0xe2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="pf6xj gMVgA52VJ.ots", cAlternateFileName="PF6XJG~1.OTS")) returned 1 [0072.980] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eec07c0, ftCreationTime.dwHighDateTime=0x1d62942, ftLastAccessTime.dwLowDateTime=0x7d5925e0, ftLastAccessTime.dwHighDateTime=0x1d628be, ftLastWriteTime.dwLowDateTime=0x878aa496, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8940, dwReserved0=0x0, dwReserved1=0x0, cFileName="vRbFPDGjNPktZYIGb.xls.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="VRBFPD~1.MAD")) returned 1 [0072.980] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b01c2f0, ftCreationTime.dwHighDateTime=0x1d62b92, ftLastAccessTime.dwLowDateTime=0x339ef7d0, ftLastAccessTime.dwHighDateTime=0x1d6236a, ftLastWriteTime.dwLowDateTime=0x878d08fa, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZEgUTL.xls.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ZEGUTL~1.MAD")) returned 1 [0072.980] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b01c2f0, ftCreationTime.dwHighDateTime=0x1d62b92, ftLastAccessTime.dwLowDateTime=0x339ef7d0, ftLastAccessTime.dwHighDateTime=0x1d6236a, ftLastWriteTime.dwLowDateTime=0x878d08fa, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZEgUTL.xls.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ZEGUTL~1.MAD")) returned 0 [0072.981] FindClose (in: hFindFile=0xac1548 | out: hFindFile=0xac1548) returned 1 [0072.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0072.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0072.981] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0072.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0072.981] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0072.981] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac13c8 [0072.981] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.981] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0072.981] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.981] FindClose (in: hFindFile=0xac13c8 | out: hFindFile=0xac13c8) returned 1 [0072.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0072.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0072.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0072.982] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0072.982] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0072.982] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.982] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0072.982] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0072.982] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0072.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0072.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0072.982] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19 [0072.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0072.982] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19 [0072.982] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0072.983] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.983] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0072.983] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0072.983] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0072.983] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0072.983] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0072.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0072.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0072.983] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Bing.url", lpFilePart=0x0) returned 0x22 [0072.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0072.983] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.037] GetFileType (hFile=0x2d0) returned 0x1 [0073.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.037] GetFileType (hFile=0x2d0) returned 0x1 [0073.037] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xd0 [0073.037] ReadFile (in: hFile=0x2d0, lpBuffer=0x280d37c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x280d37c*, lpNumberOfBytesRead=0x8fe7a0*=0xd0, lpOverlapped=0x0) returned 1 [0073.037] CloseHandle (hObject=0x2d0) returned 1 [0073.053] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Bing.url", lpFilePart=0x0) returned 0x22 [0073.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.053] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.054] GetFileType (hFile=0x2d0) returned 0x1 [0073.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.054] GetFileType (hFile=0x2d0) returned 0x1 [0073.054] WriteFile (in: hFile=0x2d0, lpBuffer=0x285b54c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x285b54c*, lpNumberOfBytesWritten=0x8fe764*=0xe0, lpOverlapped=0x0) returned 1 [0073.054] CloseHandle (hObject=0x2d0) returned 1 [0073.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Bing.url", lpFilePart=0x0) returned 0x22 [0073.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Bing.url.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4d [0073.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.055] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x8798f323, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1 [0073.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.056] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0073.056] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19 [0073.056] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8798f323, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8798f323, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1408 [0073.056] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8798f323, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8798f323, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.057] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x8798f323, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="")) returned 1 [0073.057] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.057] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0073.057] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.057] FindClose (in: hFindFile=0xac1408 | out: hFindFile=0xac1408) returned 1 [0073.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0073.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0073.057] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f [0073.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0073.057] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f [0073.057] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0073.057] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.058] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.058] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.058] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0073.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0073.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0073.058] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f [0073.058] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0073.058] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.058] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.058] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0073.058] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0073.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0073.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.059] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15 [0073.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0073.059] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15 [0073.059] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1008 [0073.059] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.059] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.059] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0073.059] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0073.059] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0073.059] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.059] FindClose (in: hFindFile=0xac1008 | out: hFindFile=0xac1008) returned 1 [0073.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0073.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0073.060] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0073.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.060] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.060] GetFileType (hFile=0x2d0) returned 0x1 [0073.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.060] GetFileType (hFile=0x2d0) returned 0x1 [0073.060] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x1f5 [0073.060] ReadFile (in: hFile=0x2d0, lpBuffer=0x285ec84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x285ec84*, lpNumberOfBytesRead=0x8fe7a0*=0x1f5, lpOverlapped=0x0) returned 1 [0073.061] CloseHandle (hObject=0x2d0) returned 1 [0073.076] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0073.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.076] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.077] GetFileType (hFile=0x2d0) returned 0x1 [0073.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.077] GetFileType (hFile=0x2d0) returned 0x1 [0073.077] WriteFile (in: hFile=0x2d0, lpBuffer=0x28ad56c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x28ad56c*, lpNumberOfBytesWritten=0x8fe764*=0x200, lpOverlapped=0x0) returned 1 [0073.078] CloseHandle (hObject=0x2d0) returned 1 [0073.078] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0073.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4c [0073.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.079] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x879b54a2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1 [0073.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.079] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0073.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.079] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.176] GetFileType (hFile=0x2d0) returned 0x1 [0073.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.176] GetFileType (hFile=0x2d0) returned 0x1 [0073.176] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x3ae [0073.176] ReadFile (in: hFile=0x2d0, lpBuffer=0x28aec04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28aec04*, lpNumberOfBytesRead=0x8fe7a0*=0x3ae, lpOverlapped=0x0) returned 1 [0073.178] CloseHandle (hObject=0x2d0) returned 1 [0073.194] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0073.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.194] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.194] GetFileType (hFile=0x2d0) returned 0x1 [0073.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.195] GetFileType (hFile=0x2d0) returned 0x1 [0073.195] WriteFile (in: hFile=0x2d0, lpBuffer=0x28fdd5c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x28fdd5c*, lpNumberOfBytesWritten=0x8fe764*=0x3b0, lpOverlapped=0x0) returned 1 [0073.195] CloseHandle (hObject=0x2d0) returned 1 [0073.196] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0073.196] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4e [0073.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x87ae68b3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0073.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.197] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.199] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0073.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.200] GetFileType (hFile=0x2d0) returned 0x1 [0073.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.200] GetFileType (hFile=0x2d0) returned 0x1 [0073.200] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x53a [0073.200] ReadFile (in: hFile=0x2d0, lpBuffer=0x28ff58c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28ff58c*, lpNumberOfBytesRead=0x8fe7a0*=0x53a, lpOverlapped=0x0) returned 1 [0073.201] CloseHandle (hObject=0x2d0) returned 1 [0073.274] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0073.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.274] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.275] GetFileType (hFile=0x2d0) returned 0x1 [0073.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.275] GetFileType (hFile=0x2d0) returned 0x1 [0073.275] WriteFile (in: hFile=0x2d0, lpBuffer=0x274f218*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x274f218*, lpNumberOfBytesWritten=0x8fe764*=0x540, lpOverlapped=0x0) returned 1 [0073.276] CloseHandle (hObject=0x2d0) returned 1 [0073.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0073.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4d [0073.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.277] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87ba54ed, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x540)) returned 1 [0073.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.277] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0073.278] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15 [0073.278] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x87ba54ed, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x87ba54ed, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1508 [0073.278] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x87ba54ed, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x87ba54ed, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.278] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.278] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x879b54a2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="")) returned 1 [0073.278] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x87ae68b3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="DOWNLO~1.MAD")) returned 1 [0073.278] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87ba54ed, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ONEDRI~1.MAD")) returned 1 [0073.279] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x87ba54ed, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ONEDRI~1.MAD")) returned 0 [0073.279] FindClose (in: hFindFile=0xac1508 | out: hFindFile=0xac1508) returned 1 [0073.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0073.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0073.279] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0073.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0073.279] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0073.279] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf7bb984, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf7bb984, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1188 [0073.279] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf7bb984, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf7bb984, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.279] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27419030, ftCreationTime.dwHighDateTime=0x1d6300b, ftLastAccessTime.dwLowDateTime=0xed491380, ftLastAccessTime.dwHighDateTime=0x1d631d6, ftLastWriteTime.dwLowDateTime=0xed491380, ftLastWriteTime.dwHighDateTime=0x1d631d6, nFileSizeHigh=0x0, nFileSizeLow=0x1587d, dwReserved0=0x0, dwReserved1=0x0, cFileName="-UBcKJbSdwNAEtixj.mp3", cAlternateFileName="-UBCKJ~1.MP3")) returned 1 [0073.279] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc407c80, ftCreationTime.dwHighDateTime=0x1d62d70, ftLastAccessTime.dwLowDateTime=0x8d6e3650, ftLastAccessTime.dwHighDateTime=0x1d628aa, ftLastWriteTime.dwLowDateTime=0x8d6e3650, ftLastWriteTime.dwHighDateTime=0x1d628aa, nFileSizeHigh=0x0, nFileSizeLow=0x9ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="7eZgLKBqbP.wav", cAlternateFileName="7EZGLK~1.WAV")) returned 1 [0073.279] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f65ec0, ftCreationTime.dwHighDateTime=0x1d62ac5, ftLastAccessTime.dwLowDateTime=0xb4b5e5f0, ftLastAccessTime.dwHighDateTime=0x1d62d7d, ftLastWriteTime.dwLowDateTime=0xb4b5e5f0, ftLastWriteTime.dwHighDateTime=0x1d62d7d, nFileSizeHigh=0x0, nFileSizeLow=0xaaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8SYDj7KOFJ.m4a", cAlternateFileName="8SYDJ7~1.M4A")) returned 1 [0073.279] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18628590, ftCreationTime.dwHighDateTime=0x1d62428, ftLastAccessTime.dwLowDateTime=0x2e1fdda0, ftLastAccessTime.dwHighDateTime=0x1d63185, ftLastWriteTime.dwLowDateTime=0x2e1fdda0, ftLastWriteTime.dwHighDateTime=0x1d63185, nFileSizeHigh=0x0, nFileSizeLow=0xf607, dwReserved0=0x0, dwReserved1=0x0, cFileName="99UnS.wav", cAlternateFileName="")) returned 1 [0073.280] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa49871a0, ftCreationTime.dwHighDateTime=0x1d632e2, ftLastAccessTime.dwLowDateTime=0xbab01ec0, ftLastAccessTime.dwHighDateTime=0x1d62982, ftLastWriteTime.dwLowDateTime=0xbab01ec0, ftLastWriteTime.dwHighDateTime=0x1d62982, nFileSizeHigh=0x0, nFileSizeLow=0x14cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="aEHzWaQlOqA79moBc.mp3", cAlternateFileName="AEHZWA~1.MP3")) returned 1 [0073.280] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a0a0, ftCreationTime.dwHighDateTime=0x1d6244a, ftLastAccessTime.dwLowDateTime=0xd3419fa0, ftLastAccessTime.dwHighDateTime=0x1d62ff3, ftLastWriteTime.dwLowDateTime=0xd3419fa0, ftLastWriteTime.dwHighDateTime=0x1d62ff3, nFileSizeHigh=0x0, nFileSizeLow=0xfb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ck6wfz2nuxPEMj.m4a", cAlternateFileName="CK6WFZ~1.M4A")) returned 1 [0073.280] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.280] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f4db30, ftCreationTime.dwHighDateTime=0x1d628db, ftLastAccessTime.dwLowDateTime=0xc5e893d0, ftLastAccessTime.dwHighDateTime=0x1d62865, ftLastWriteTime.dwLowDateTime=0xc5e893d0, ftLastWriteTime.dwHighDateTime=0x1d62865, nFileSizeHigh=0x0, nFileSizeLow=0x12c95, dwReserved0=0x0, dwReserved1=0x0, cFileName="e CB eqE0w dD21yZ.wav", cAlternateFileName="ECBEQE~1.WAV")) returned 1 [0073.280] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc894f360, ftCreationTime.dwHighDateTime=0x1d62c7c, ftLastAccessTime.dwLowDateTime=0x667e2690, ftLastAccessTime.dwHighDateTime=0x1d6284b, ftLastWriteTime.dwLowDateTime=0x667e2690, ftLastWriteTime.dwHighDateTime=0x1d6284b, nFileSizeHigh=0x0, nFileSizeLow=0x4d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="ekrukokm5yX7II.wav", cAlternateFileName="EKRUKO~1.WAV")) returned 1 [0073.280] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97683b70, ftCreationTime.dwHighDateTime=0x1d62ff2, ftLastAccessTime.dwLowDateTime=0x6240b230, ftLastAccessTime.dwHighDateTime=0x1d62983, ftLastWriteTime.dwLowDateTime=0x6240b230, ftLastWriteTime.dwHighDateTime=0x1d62983, nFileSizeHigh=0x0, nFileSizeLow=0x11169, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAZzBOf0rSmIun.m4a", cAlternateFileName="FAZZBO~1.M4A")) returned 1 [0073.280] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90139c20, ftCreationTime.dwHighDateTime=0x1d63213, ftLastAccessTime.dwLowDateTime=0xe5ff0810, ftLastAccessTime.dwHighDateTime=0x1d62a1e, ftLastWriteTime.dwLowDateTime=0xe5ff0810, ftLastWriteTime.dwHighDateTime=0x1d62a1e, nFileSizeHigh=0x0, nFileSizeLow=0x10fc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="JMpVsK.m4a", cAlternateFileName="")) returned 1 [0073.280] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149b62e0, ftCreationTime.dwHighDateTime=0x1d628f3, ftLastAccessTime.dwLowDateTime=0xae7ea120, ftLastAccessTime.dwHighDateTime=0x1d62564, ftLastWriteTime.dwLowDateTime=0xae7ea120, ftLastWriteTime.dwHighDateTime=0x1d62564, nFileSizeHigh=0x0, nFileSizeLow=0x8550, dwReserved0=0x0, dwReserved1=0x0, cFileName="kMc2Fkq6.wav", cAlternateFileName="")) returned 1 [0073.280] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84af5110, ftCreationTime.dwHighDateTime=0x1d62838, ftLastAccessTime.dwLowDateTime=0xdcf14590, ftLastAccessTime.dwHighDateTime=0x1d62ff9, ftLastWriteTime.dwLowDateTime=0xdcf14590, ftLastWriteTime.dwHighDateTime=0x1d62ff9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KxKDZ_zTD", cAlternateFileName="KXKDZ_~1")) returned 1 [0073.280] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc654bd10, ftCreationTime.dwHighDateTime=0x1d630be, ftLastAccessTime.dwLowDateTime=0xee45c7c0, ftLastAccessTime.dwHighDateTime=0x1d62d5c, ftLastWriteTime.dwLowDateTime=0xee45c7c0, ftLastWriteTime.dwHighDateTime=0x1d62d5c, nFileSizeHigh=0x0, nFileSizeLow=0x219c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM3u5UsROn.m4a", cAlternateFileName="MM3U5U~1.M4A")) returned 1 [0073.280] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12065c80, ftCreationTime.dwHighDateTime=0x1d62969, ftLastAccessTime.dwLowDateTime=0x845bb9c0, ftLastAccessTime.dwHighDateTime=0x1d6263e, ftLastWriteTime.dwLowDateTime=0x845bb9c0, ftLastWriteTime.dwHighDateTime=0x1d6263e, nFileSizeHigh=0x0, nFileSizeLow=0xf9a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="O0-mvJT1wxh5ktJbk.wav", cAlternateFileName="O0-MVJ~1.WAV")) returned 1 [0073.281] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c6fa30, ftCreationTime.dwHighDateTime=0x1d62fbc, ftLastAccessTime.dwLowDateTime=0x164a4320, ftLastAccessTime.dwHighDateTime=0x1d62c5b, ftLastWriteTime.dwLowDateTime=0x164a4320, ftLastWriteTime.dwHighDateTime=0x1d62c5b, nFileSizeHigh=0x0, nFileSizeLow=0x8961, dwReserved0=0x0, dwReserved1=0x0, cFileName="QjMbGbfsehOx80B9ya.mp3", cAlternateFileName="QJMBGB~1.MP3")) returned 1 [0073.281] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x815157e0, ftCreationTime.dwHighDateTime=0x1d629cb, ftLastAccessTime.dwLowDateTime=0x51053040, ftLastAccessTime.dwHighDateTime=0x1d62c62, ftLastWriteTime.dwLowDateTime=0x51053040, ftLastWriteTime.dwHighDateTime=0x1d62c62, nFileSizeHigh=0x0, nFileSizeLow=0x8c5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="wzSP4zI-EKmE OghX.wav", cAlternateFileName="WZSP4Z~1.WAV")) returned 1 [0073.281] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26fbaf50, ftCreationTime.dwHighDateTime=0x1d6245f, ftLastAccessTime.dwLowDateTime=0x4bc03520, ftLastAccessTime.dwHighDateTime=0x1d632b7, ftLastWriteTime.dwLowDateTime=0x4bc03520, ftLastWriteTime.dwHighDateTime=0x1d632b7, nFileSizeHigh=0x0, nFileSizeLow=0x117a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y8MolS04eAAnZyGlhg.wav", cAlternateFileName="Y8MOLS~1.WAV")) returned 1 [0073.281] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3746e380, ftCreationTime.dwHighDateTime=0x1d629f4, ftLastAccessTime.dwLowDateTime=0x376e85d0, ftLastAccessTime.dwHighDateTime=0x1d624bc, ftLastWriteTime.dwLowDateTime=0x376e85d0, ftLastWriteTime.dwHighDateTime=0x1d624bc, nFileSizeHigh=0x0, nFileSizeLow=0x15ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="YGJfPZx7pB7jln 8kCey.m4a", cAlternateFileName="YGJFPZ~1.M4A")) returned 1 [0073.281] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.281] FindClose (in: hFindFile=0xac1188 | out: hFindFile=0xac1188) returned 1 [0073.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0073.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0073.281] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3", lpFilePart=0x0) returned 0x2b [0073.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.281] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-ubckjbsdwnaetixj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.281] GetFileType (hFile=0x2d0) returned 0x1 [0073.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.281] GetFileType (hFile=0x2d0) returned 0x1 [0073.281] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x1587d [0073.282] ReadFile (in: hFile=0x2d0, lpBuffer=0x3830348, nNumberOfBytesToRead=0x1587d, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x3830348*, lpNumberOfBytesRead=0x8fe7a0*=0x1587d, lpOverlapped=0x0) returned 1 [0073.283] CloseHandle (hObject=0x2d0) returned 1 [0073.363] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3", lpFilePart=0x0) returned 0x2b [0073.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.363] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-ubckjbsdwnaetixj.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.364] GetFileType (hFile=0x2d0) returned 0x1 [0073.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.364] GetFileType (hFile=0x2d0) returned 0x1 [0073.364] WriteFile (in: hFile=0x2d0, lpBuffer=0x389be08*, nNumberOfBytesToWrite=0x15880, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x389be08*, lpNumberOfBytesWritten=0x8fe790*=0x15880, lpOverlapped=0x0) returned 1 [0073.366] CloseHandle (hObject=0x2d0) returned 1 [0073.368] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3", lpFilePart=0x0) returned 0x2b [0073.368] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x56 [0073.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.368] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-ubckjbsdwnaetixj.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27419030, ftCreationTime.dwHighDateTime=0x1d6300b, ftLastAccessTime.dwLowDateTime=0xed491380, ftLastAccessTime.dwHighDateTime=0x1d631d6, ftLastWriteTime.dwLowDateTime=0x87c8a29f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15880)) returned 1 [0073.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.368] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-ubckjbsdwnaetixj.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-UBcKJbSdwNAEtixj.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\-ubckjbsdwnaetixj.mp3.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.369] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav", lpFilePart=0x0) returned 0x24 [0073.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.369] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav" (normalized: "c:\\users\\fd1hvy\\music\\7ezglkbqbp.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.369] GetFileType (hFile=0x2d0) returned 0x1 [0073.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.369] GetFileType (hFile=0x2d0) returned 0x1 [0073.369] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x9ca4 [0073.369] ReadFile (in: hFile=0x2d0, lpBuffer=0x27a0c60, nNumberOfBytesToRead=0x9ca4, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27a0c60*, lpNumberOfBytesRead=0x8fe7a0*=0x9ca4, lpOverlapped=0x0) returned 1 [0073.369] CloseHandle (hObject=0x2d0) returned 1 [0073.388] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav", lpFilePart=0x0) returned 0x24 [0073.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.388] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav" (normalized: "c:\\users\\fd1hvy\\music\\7ezglkbqbp.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.389] GetFileType (hFile=0x2d0) returned 0x1 [0073.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.389] GetFileType (hFile=0x2d0) returned 0x1 [0073.389] WriteFile (in: hFile=0x2d0, lpBuffer=0x281e9d0*, nNumberOfBytesToWrite=0x9cb0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x281e9d0*, lpNumberOfBytesWritten=0x8fe790*=0x9cb0, lpOverlapped=0x0) returned 1 [0073.390] CloseHandle (hObject=0x2d0) returned 1 [0073.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav", lpFilePart=0x0) returned 0x24 [0073.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4f [0073.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.392] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav" (normalized: "c:\\users\\fd1hvy\\music\\7ezglkbqbp.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc407c80, ftCreationTime.dwHighDateTime=0x1d62d70, ftLastAccessTime.dwLowDateTime=0x8d6e3650, ftLastAccessTime.dwHighDateTime=0x1d628aa, ftLastWriteTime.dwLowDateTime=0x87cb05c4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9cb0)) returned 1 [0073.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.443] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav" (normalized: "c:\\users\\fd1hvy\\music\\7ezglkbqbp.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\7eZgLKBqbP.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\7ezglkbqbp.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.445] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\99UnS.wav", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\99UnS.wav", lpFilePart=0x0) returned 0x1f [0073.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.446] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\99UnS.wav" (normalized: "c:\\users\\fd1hvy\\music\\99uns.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.446] GetFileType (hFile=0x2d0) returned 0x1 [0073.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.446] GetFileType (hFile=0x2d0) returned 0x1 [0073.446] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xf607 [0073.446] ReadFile (in: hFile=0x2d0, lpBuffer=0x2828a54, nNumberOfBytesToRead=0xf607, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2828a54*, lpNumberOfBytesRead=0x8fe7a0*=0xf607, lpOverlapped=0x0) returned 1 [0073.446] CloseHandle (hObject=0x2d0) returned 1 [0073.463] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\99UnS.wav", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\99UnS.wav", lpFilePart=0x0) returned 0x1f [0073.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.464] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\99UnS.wav" (normalized: "c:\\users\\fd1hvy\\music\\99uns.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.464] GetFileType (hFile=0x2d0) returned 0x1 [0073.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.464] GetFileType (hFile=0x2d0) returned 0x1 [0073.464] WriteFile (in: hFile=0x2d0, lpBuffer=0x28a3a9c*, nNumberOfBytesToWrite=0xf610, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x28a3a9c*, lpNumberOfBytesWritten=0x8fe790*=0xf610, lpOverlapped=0x0) returned 1 [0073.466] CloseHandle (hObject=0x2d0) returned 1 [0073.467] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\99UnS.wav", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\99UnS.wav", lpFilePart=0x0) returned 0x1f [0073.467] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\99UnS.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\99UnS.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4a [0073.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.467] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\99UnS.wav" (normalized: "c:\\users\\fd1hvy\\music\\99uns.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18628590, ftCreationTime.dwHighDateTime=0x1d62428, ftLastAccessTime.dwLowDateTime=0x2e1fdda0, ftLastAccessTime.dwHighDateTime=0x1d63185, ftLastWriteTime.dwLowDateTime=0x87d6f0d3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf610)) returned 1 [0073.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.468] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\99UnS.wav" (normalized: "c:\\users\\fd1hvy\\music\\99uns.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\99UnS.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\99uns.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.468] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3", lpFilePart=0x0) returned 0x2b [0073.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.468] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3" (normalized: "c:\\users\\fd1hvy\\music\\aehzwaqloqa79mobc.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.468] GetFileType (hFile=0x2d0) returned 0x1 [0073.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.468] GetFileType (hFile=0x2d0) returned 0x1 [0073.468] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x14cb [0073.469] ReadFile (in: hFile=0x2d0, lpBuffer=0x28b3464, nNumberOfBytesToRead=0x14cb, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28b3464*, lpNumberOfBytesRead=0x8fe7a0*=0x14cb, lpOverlapped=0x0) returned 1 [0073.469] CloseHandle (hObject=0x2d0) returned 1 [0073.484] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3", lpFilePart=0x0) returned 0x2b [0073.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.484] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3" (normalized: "c:\\users\\fd1hvy\\music\\aehzwaqloqa79mobc.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.485] GetFileType (hFile=0x2d0) returned 0x1 [0073.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.485] GetFileType (hFile=0x2d0) returned 0x1 [0073.485] WriteFile (in: hFile=0x2d0, lpBuffer=0x2906a78*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2906a78*, lpNumberOfBytesWritten=0x8fe790*=0x14d0, lpOverlapped=0x0) returned 1 [0073.486] CloseHandle (hObject=0x2d0) returned 1 [0073.527] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3", lpFilePart=0x0) returned 0x2b [0073.528] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x56 [0073.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.528] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3" (normalized: "c:\\users\\fd1hvy\\music\\aehzwaqloqa79mobc.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa49871a0, ftCreationTime.dwHighDateTime=0x1d632e2, ftLastAccessTime.dwLowDateTime=0xbab01ec0, ftLastAccessTime.dwHighDateTime=0x1d62982, ftLastWriteTime.dwLowDateTime=0x87e07a94, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x14d0)) returned 1 [0073.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.528] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3" (normalized: "c:\\users\\fd1hvy\\music\\aehzwaqloqa79mobc.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\aEHzWaQlOqA79moBc.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\aehzwaqloqa79mobc.mp3.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.528] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav", lpFilePart=0x0) returned 0x2b [0073.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.529] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav" (normalized: "c:\\users\\fd1hvy\\music\\e cb eqe0w dd21yz.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.529] GetFileType (hFile=0x2d0) returned 0x1 [0073.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.529] GetFileType (hFile=0x2d0) returned 0x1 [0073.529] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x12c95 [0073.529] ReadFile (in: hFile=0x2d0, lpBuffer=0x29083a8, nNumberOfBytesToRead=0x12c95, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x29083a8*, lpNumberOfBytesRead=0x8fe7a0*=0x12c95, lpOverlapped=0x0) returned 1 [0073.529] CloseHandle (hObject=0x2d0) returned 1 [0073.618] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav", lpFilePart=0x0) returned 0x2b [0073.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.618] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav" (normalized: "c:\\users\\fd1hvy\\music\\e cb eqe0w dd21yz.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.619] GetFileType (hFile=0x2d0) returned 0x1 [0073.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.619] GetFileType (hFile=0x2d0) returned 0x1 [0073.619] WriteFile (in: hFile=0x2d0, lpBuffer=0x2795064*, nNumberOfBytesToWrite=0x12ca0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2795064*, lpNumberOfBytesWritten=0x8fe790*=0x12ca0, lpOverlapped=0x0) returned 1 [0073.621] CloseHandle (hObject=0x2d0) returned 1 [0073.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav", lpFilePart=0x0) returned 0x2b [0073.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x56 [0073.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav" (normalized: "c:\\users\\fd1hvy\\music\\e cb eqe0w dd21yz.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f4db30, ftCreationTime.dwHighDateTime=0x1d628db, ftLastAccessTime.dwLowDateTime=0xc5e893d0, ftLastAccessTime.dwHighDateTime=0x1d62865, ftLastWriteTime.dwLowDateTime=0x87eec80f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12ca0)) returned 1 [0073.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.623] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav" (normalized: "c:\\users\\fd1hvy\\music\\e cb eqe0w dd21yz.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\e CB eqE0w dD21yZ.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\e cb eqe0w dd21yz.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.623] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav", lpFilePart=0x0) returned 0x28 [0073.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.623] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav" (normalized: "c:\\users\\fd1hvy\\music\\ekrukokm5yx7ii.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.623] GetFileType (hFile=0x2d0) returned 0x1 [0073.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.623] GetFileType (hFile=0x2d0) returned 0x1 [0073.623] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x4d83 [0073.624] ReadFile (in: hFile=0x2d0, lpBuffer=0x27a812c, nNumberOfBytesToRead=0x4d83, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27a812c*, lpNumberOfBytesRead=0x8fe7a0*=0x4d83, lpOverlapped=0x0) returned 1 [0073.624] CloseHandle (hObject=0x2d0) returned 1 [0073.640] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav", lpFilePart=0x0) returned 0x28 [0073.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.640] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav" (normalized: "c:\\users\\fd1hvy\\music\\ekrukokm5yx7ii.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.640] GetFileType (hFile=0x2d0) returned 0x1 [0073.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.640] GetFileType (hFile=0x2d0) returned 0x1 [0073.641] WriteFile (in: hFile=0x2d0, lpBuffer=0x280d45c*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x280d45c*, lpNumberOfBytesWritten=0x8fe790*=0x4d90, lpOverlapped=0x0) returned 1 [0073.641] CloseHandle (hObject=0x2d0) returned 1 [0073.643] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav", lpFilePart=0x0) returned 0x28 [0073.643] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x53 [0073.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.643] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav" (normalized: "c:\\users\\fd1hvy\\music\\ekrukokm5yx7ii.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc894f360, ftCreationTime.dwHighDateTime=0x1d62c7c, ftLastAccessTime.dwLowDateTime=0x667e2690, ftLastAccessTime.dwHighDateTime=0x1d6284b, ftLastWriteTime.dwLowDateTime=0x87f393d2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4d90)) returned 1 [0073.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.643] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav" (normalized: "c:\\users\\fd1hvy\\music\\ekrukokm5yx7ii.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\ekrukokm5yX7II.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\ekrukokm5yx7ii.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.644] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav", lpFilePart=0x0) returned 0x22 [0073.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.644] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav" (normalized: "c:\\users\\fd1hvy\\music\\kmc2fkq6.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.644] GetFileType (hFile=0x2d0) returned 0x1 [0073.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.644] GetFileType (hFile=0x2d0) returned 0x1 [0073.644] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x8550 [0073.644] ReadFile (in: hFile=0x2d0, lpBuffer=0x2812610, nNumberOfBytesToRead=0x8550, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2812610*, lpNumberOfBytesRead=0x8fe7a0*=0x8550, lpOverlapped=0x0) returned 1 [0073.644] CloseHandle (hObject=0x2d0) returned 1 [0073.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav", lpFilePart=0x0) returned 0x22 [0073.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav" (normalized: "c:\\users\\fd1hvy\\music\\kmc2fkq6.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.722] GetFileType (hFile=0x2d0) returned 0x1 [0073.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.722] GetFileType (hFile=0x2d0) returned 0x1 [0073.722] WriteFile (in: hFile=0x2d0, lpBuffer=0x2888ef0*, nNumberOfBytesToWrite=0x8560, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2888ef0*, lpNumberOfBytesWritten=0x8fe790*=0x8560, lpOverlapped=0x0) returned 1 [0073.723] CloseHandle (hObject=0x2d0) returned 1 [0073.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav", lpFilePart=0x0) returned 0x22 [0073.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4d [0073.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.724] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav" (normalized: "c:\\users\\fd1hvy\\music\\kmc2fkq6.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149b62e0, ftCreationTime.dwHighDateTime=0x1d628f3, ftLastAccessTime.dwLowDateTime=0xae7ea120, ftLastAccessTime.dwHighDateTime=0x1d62564, ftLastWriteTime.dwLowDateTime=0x87ff7878, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8560)) returned 1 [0073.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.725] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav" (normalized: "c:\\users\\fd1hvy\\music\\kmc2fkq6.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\kMc2Fkq6.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\kmc2fkq6.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav", lpFilePart=0x0) returned 0x2b [0073.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.725] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav" (normalized: "c:\\users\\fd1hvy\\music\\o0-mvjt1wxh5ktjbk.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.725] GetFileType (hFile=0x2d0) returned 0x1 [0073.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.725] GetFileType (hFile=0x2d0) returned 0x1 [0073.726] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xf9a5 [0073.726] ReadFile (in: hFile=0x2d0, lpBuffer=0x2891840, nNumberOfBytesToRead=0xf9a5, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2891840*, lpNumberOfBytesRead=0x8fe7a0*=0xf9a5, lpOverlapped=0x0) returned 1 [0073.726] CloseHandle (hObject=0x2d0) returned 1 [0073.744] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav", lpFilePart=0x0) returned 0x2b [0073.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.744] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav" (normalized: "c:\\users\\fd1hvy\\music\\o0-mvjt1wxh5ktjbk.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.745] GetFileType (hFile=0x2d0) returned 0x1 [0073.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.745] GetFileType (hFile=0x2d0) returned 0x1 [0073.745] WriteFile (in: hFile=0x2d0, lpBuffer=0x290d368*, nNumberOfBytesToWrite=0xf9b0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x290d368*, lpNumberOfBytesWritten=0x8fe790*=0xf9b0, lpOverlapped=0x0) returned 1 [0073.746] CloseHandle (hObject=0x2d0) returned 1 [0073.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav", lpFilePart=0x0) returned 0x2b [0073.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x56 [0073.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.747] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav" (normalized: "c:\\users\\fd1hvy\\music\\o0-mvjt1wxh5ktjbk.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12065c80, ftCreationTime.dwHighDateTime=0x1d62969, ftLastAccessTime.dwLowDateTime=0x845bb9c0, ftLastAccessTime.dwHighDateTime=0x1d6263e, ftLastWriteTime.dwLowDateTime=0x8801db31, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf9b0)) returned 1 [0073.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.748] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav" (normalized: "c:\\users\\fd1hvy\\music\\o0-mvjt1wxh5ktjbk.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\O0-mvJT1wxh5ktJbk.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\o0-mvjt1wxh5ktjbk.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.748] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3", lpFilePart=0x0) returned 0x2c [0073.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.748] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3" (normalized: "c:\\users\\fd1hvy\\music\\qjmbgbfsehox80b9ya.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.748] GetFileType (hFile=0x2d0) returned 0x1 [0073.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.748] GetFileType (hFile=0x2d0) returned 0x1 [0073.748] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x8961 [0073.749] ReadFile (in: hFile=0x2d0, lpBuffer=0x291d150, nNumberOfBytesToRead=0x8961, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x291d150*, lpNumberOfBytesRead=0x8fe7a0*=0x8961, lpOverlapped=0x0) returned 1 [0073.749] CloseHandle (hObject=0x2d0) returned 1 [0073.849] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3", lpFilePart=0x0) returned 0x2c [0073.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.849] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3" (normalized: "c:\\users\\fd1hvy\\music\\qjmbgbfsehox80b9ya.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.850] GetFileType (hFile=0x2d0) returned 0x1 [0073.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.850] GetFileType (hFile=0x2d0) returned 0x1 [0073.850] WriteFile (in: hFile=0x2d0, lpBuffer=0x27882c4*, nNumberOfBytesToWrite=0x8970, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27882c4*, lpNumberOfBytesWritten=0x8fe790*=0x8970, lpOverlapped=0x0) returned 1 [0073.851] CloseHandle (hObject=0x2d0) returned 1 [0073.852] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3", lpFilePart=0x0) returned 0x2c [0073.852] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0073.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.853] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3" (normalized: "c:\\users\\fd1hvy\\music\\qjmbgbfsehox80b9ya.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c6fa30, ftCreationTime.dwHighDateTime=0x1d62fbc, ftLastAccessTime.dwLowDateTime=0x164a4320, ftLastAccessTime.dwHighDateTime=0x1d62c5b, ftLastWriteTime.dwLowDateTime=0x88128a93, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8970)) returned 1 [0073.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.853] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3" (normalized: "c:\\users\\fd1hvy\\music\\qjmbgbfsehox80b9ya.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\QjMbGbfsehOx80B9ya.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\qjmbgbfsehox80b9ya.mp3.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav", lpFilePart=0x0) returned 0x2b [0073.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.854] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav" (normalized: "c:\\users\\fd1hvy\\music\\wzsp4zi-ekme oghx.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.854] GetFileType (hFile=0x2d0) returned 0x1 [0073.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.854] GetFileType (hFile=0x2d0) returned 0x1 [0073.854] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x8c5f [0073.854] ReadFile (in: hFile=0x2d0, lpBuffer=0x2791070, nNumberOfBytesToRead=0x8c5f, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2791070*, lpNumberOfBytesRead=0x8fe7a0*=0x8c5f, lpOverlapped=0x0) returned 1 [0073.854] CloseHandle (hObject=0x2d0) returned 1 [0073.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav", lpFilePart=0x0) returned 0x2b [0073.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.870] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav" (normalized: "c:\\users\\fd1hvy\\music\\wzsp4zi-ekme oghx.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.871] GetFileType (hFile=0x2d0) returned 0x1 [0073.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.871] GetFileType (hFile=0x2d0) returned 0x1 [0073.871] WriteFile (in: hFile=0x2d0, lpBuffer=0x2809db0*, nNumberOfBytesToWrite=0x8c60, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2809db0*, lpNumberOfBytesWritten=0x8fe790*=0x8c60, lpOverlapped=0x0) returned 1 [0073.872] CloseHandle (hObject=0x2d0) returned 1 [0073.873] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav", lpFilePart=0x0) returned 0x2b [0073.873] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x56 [0073.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav" (normalized: "c:\\users\\fd1hvy\\music\\wzsp4zi-ekme oghx.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x815157e0, ftCreationTime.dwHighDateTime=0x1d629cb, ftLastAccessTime.dwLowDateTime=0x51053040, ftLastAccessTime.dwHighDateTime=0x1d62c62, ftLastWriteTime.dwLowDateTime=0x8814edc9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8c60)) returned 1 [0073.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.873] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav" (normalized: "c:\\users\\fd1hvy\\music\\wzsp4zi-ekme oghx.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\wzSP4zI-EKmE OghX.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\wzsp4zi-ekme oghx.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav", lpFilePart=0x0) returned 0x2c [0073.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0073.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav" (normalized: "c:\\users\\fd1hvy\\music\\y8mols04eaanzyglhg.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.874] GetFileType (hFile=0x2d0) returned 0x1 [0073.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0073.874] GetFileType (hFile=0x2d0) returned 0x1 [0073.874] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x117a4 [0073.874] ReadFile (in: hFile=0x2d0, lpBuffer=0x2812e48, nNumberOfBytesToRead=0x117a4, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2812e48*, lpNumberOfBytesRead=0x8fe7a0*=0x117a4, lpOverlapped=0x0) returned 1 [0073.875] CloseHandle (hObject=0x2d0) returned 1 [0073.950] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav", lpFilePart=0x0) returned 0x2c [0073.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0073.950] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav" (normalized: "c:\\users\\fd1hvy\\music\\y8mols04eaanzyglhg.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.951] GetFileType (hFile=0x2d0) returned 0x1 [0073.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0073.951] GetFileType (hFile=0x2d0) returned 0x1 [0073.951] WriteFile (in: hFile=0x2d0, lpBuffer=0x289436c*, nNumberOfBytesToWrite=0x117b0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x289436c*, lpNumberOfBytesWritten=0x8fe790*=0x117b0, lpOverlapped=0x0) returned 1 [0073.953] CloseHandle (hObject=0x2d0) returned 1 [0073.954] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav", lpFilePart=0x0) returned 0x2c [0073.954] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0073.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0073.955] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav" (normalized: "c:\\users\\fd1hvy\\music\\y8mols04eaanzyglhg.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26fbaf50, ftCreationTime.dwHighDateTime=0x1d6245f, ftLastAccessTime.dwLowDateTime=0x4bc03520, ftLastAccessTime.dwHighDateTime=0x1d632b7, ftLastWriteTime.dwLowDateTime=0x8820d95a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x117b0)) returned 1 [0073.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.955] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav" (normalized: "c:\\users\\fd1hvy\\music\\y8mols04eaanzyglhg.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Y8MolS04eAAnZyGlhg.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\y8mols04eaanzyglhg.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0073.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0073.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0073.956] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x88233d69, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x88233d69, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0073.956] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x88233d69, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x88233d69, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.956] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27419030, ftCreationTime.dwHighDateTime=0x1d6300b, ftLastAccessTime.dwLowDateTime=0xed491380, ftLastAccessTime.dwHighDateTime=0x1d631d6, ftLastWriteTime.dwLowDateTime=0x87c8a29f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15880, dwReserved0=0x0, dwReserved1=0x0, cFileName="-UBcKJbSdwNAEtixj.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="-UBCKJ~1.MAD")) returned 1 [0073.957] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc407c80, ftCreationTime.dwHighDateTime=0x1d62d70, ftLastAccessTime.dwLowDateTime=0x8d6e3650, ftLastAccessTime.dwHighDateTime=0x1d628aa, ftLastWriteTime.dwLowDateTime=0x87cb05c4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9cb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7eZgLKBqbP.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="7EZGLK~1.MAD")) returned 1 [0073.957] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f65ec0, ftCreationTime.dwHighDateTime=0x1d62ac5, ftLastAccessTime.dwLowDateTime=0xb4b5e5f0, ftLastAccessTime.dwHighDateTime=0x1d62d7d, ftLastWriteTime.dwLowDateTime=0xb4b5e5f0, ftLastWriteTime.dwHighDateTime=0x1d62d7d, nFileSizeHigh=0x0, nFileSizeLow=0xaaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8SYDj7KOFJ.m4a", cAlternateFileName="8SYDJ7~1.M4A")) returned 1 [0073.957] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18628590, ftCreationTime.dwHighDateTime=0x1d62428, ftLastAccessTime.dwLowDateTime=0x2e1fdda0, ftLastAccessTime.dwHighDateTime=0x1d63185, ftLastWriteTime.dwLowDateTime=0x87d6f0d3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf610, dwReserved0=0x0, dwReserved1=0x0, cFileName="99UnS.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="99UNSW~1.MAD")) returned 1 [0073.957] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa49871a0, ftCreationTime.dwHighDateTime=0x1d632e2, ftLastAccessTime.dwLowDateTime=0xbab01ec0, ftLastAccessTime.dwHighDateTime=0x1d62982, ftLastWriteTime.dwLowDateTime=0x87e07a94, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x14d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aEHzWaQlOqA79moBc.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="AEHZWA~1.MAD")) returned 1 [0073.957] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a0a0, ftCreationTime.dwHighDateTime=0x1d6244a, ftLastAccessTime.dwLowDateTime=0xd3419fa0, ftLastAccessTime.dwHighDateTime=0x1d62ff3, ftLastWriteTime.dwLowDateTime=0xd3419fa0, ftLastWriteTime.dwHighDateTime=0x1d62ff3, nFileSizeHigh=0x0, nFileSizeLow=0xfb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ck6wfz2nuxPEMj.m4a", cAlternateFileName="CK6WFZ~1.M4A")) returned 1 [0073.957] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.957] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78f4db30, ftCreationTime.dwHighDateTime=0x1d628db, ftLastAccessTime.dwLowDateTime=0xc5e893d0, ftLastAccessTime.dwHighDateTime=0x1d62865, ftLastWriteTime.dwLowDateTime=0x87eec80f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12ca0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e CB eqE0w dD21yZ.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ECBEQE~1.MAD")) returned 1 [0073.957] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc894f360, ftCreationTime.dwHighDateTime=0x1d62c7c, ftLastAccessTime.dwLowDateTime=0x667e2690, ftLastAccessTime.dwHighDateTime=0x1d6284b, ftLastWriteTime.dwLowDateTime=0x87f393d2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ekrukokm5yX7II.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EKRUKO~1.MAD")) returned 1 [0073.957] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97683b70, ftCreationTime.dwHighDateTime=0x1d62ff2, ftLastAccessTime.dwLowDateTime=0x6240b230, ftLastAccessTime.dwHighDateTime=0x1d62983, ftLastWriteTime.dwLowDateTime=0x6240b230, ftLastWriteTime.dwHighDateTime=0x1d62983, nFileSizeHigh=0x0, nFileSizeLow=0x11169, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAZzBOf0rSmIun.m4a", cAlternateFileName="FAZZBO~1.M4A")) returned 1 [0073.957] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90139c20, ftCreationTime.dwHighDateTime=0x1d63213, ftLastAccessTime.dwLowDateTime=0xe5ff0810, ftLastAccessTime.dwHighDateTime=0x1d62a1e, ftLastWriteTime.dwLowDateTime=0xe5ff0810, ftLastWriteTime.dwHighDateTime=0x1d62a1e, nFileSizeHigh=0x0, nFileSizeLow=0x10fc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="JMpVsK.m4a", cAlternateFileName="")) returned 1 [0073.958] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149b62e0, ftCreationTime.dwHighDateTime=0x1d628f3, ftLastAccessTime.dwLowDateTime=0xae7ea120, ftLastAccessTime.dwHighDateTime=0x1d62564, ftLastWriteTime.dwLowDateTime=0x87ff7878, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8560, dwReserved0=0x0, dwReserved1=0x0, cFileName="kMc2Fkq6.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="KMC2FK~1.MAD")) returned 1 [0073.958] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84af5110, ftCreationTime.dwHighDateTime=0x1d62838, ftLastAccessTime.dwLowDateTime=0xdcf14590, ftLastAccessTime.dwHighDateTime=0x1d62ff9, ftLastWriteTime.dwLowDateTime=0xdcf14590, ftLastWriteTime.dwHighDateTime=0x1d62ff9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KxKDZ_zTD", cAlternateFileName="KXKDZ_~1")) returned 1 [0073.958] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc654bd10, ftCreationTime.dwHighDateTime=0x1d630be, ftLastAccessTime.dwLowDateTime=0xee45c7c0, ftLastAccessTime.dwHighDateTime=0x1d62d5c, ftLastWriteTime.dwLowDateTime=0xee45c7c0, ftLastWriteTime.dwHighDateTime=0x1d62d5c, nFileSizeHigh=0x0, nFileSizeLow=0x219c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM3u5UsROn.m4a", cAlternateFileName="MM3U5U~1.M4A")) returned 1 [0073.958] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12065c80, ftCreationTime.dwHighDateTime=0x1d62969, ftLastAccessTime.dwLowDateTime=0x845bb9c0, ftLastAccessTime.dwHighDateTime=0x1d6263e, ftLastWriteTime.dwLowDateTime=0x8801db31, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf9b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="O0-mvJT1wxh5ktJbk.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="O0-MVJ~1.MAD")) returned 1 [0073.958] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c6fa30, ftCreationTime.dwHighDateTime=0x1d62fbc, ftLastAccessTime.dwLowDateTime=0x164a4320, ftLastAccessTime.dwHighDateTime=0x1d62c5b, ftLastWriteTime.dwLowDateTime=0x88128a93, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8970, dwReserved0=0x0, dwReserved1=0x0, cFileName="QjMbGbfsehOx80B9ya.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="QJMBGB~1.MAD")) returned 1 [0073.958] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x815157e0, ftCreationTime.dwHighDateTime=0x1d629cb, ftLastAccessTime.dwLowDateTime=0x51053040, ftLastAccessTime.dwHighDateTime=0x1d62c62, ftLastWriteTime.dwLowDateTime=0x8814edc9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="wzSP4zI-EKmE OghX.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="WZSP4Z~1.MAD")) returned 1 [0073.958] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26fbaf50, ftCreationTime.dwHighDateTime=0x1d6245f, ftLastAccessTime.dwLowDateTime=0x4bc03520, ftLastAccessTime.dwHighDateTime=0x1d632b7, ftLastWriteTime.dwLowDateTime=0x8820d95a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x117b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y8MolS04eAAnZyGlhg.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="Y8MOLS~1.MAD")) returned 1 [0073.958] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3746e380, ftCreationTime.dwHighDateTime=0x1d629f4, ftLastAccessTime.dwLowDateTime=0x376e85d0, ftLastAccessTime.dwHighDateTime=0x1d624bc, ftLastWriteTime.dwLowDateTime=0x376e85d0, ftLastWriteTime.dwHighDateTime=0x1d624bc, nFileSizeHigh=0x0, nFileSizeLow=0x15ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="YGJfPZx7pB7jln 8kCey.m4a", cAlternateFileName="YGJFPZ~1.M4A")) returned 1 [0073.958] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3746e380, ftCreationTime.dwHighDateTime=0x1d629f4, ftLastAccessTime.dwLowDateTime=0x376e85d0, ftLastAccessTime.dwHighDateTime=0x1d624bc, ftLastWriteTime.dwLowDateTime=0x376e85d0, ftLastWriteTime.dwHighDateTime=0x1d624bc, nFileSizeHigh=0x0, nFileSizeLow=0x15ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="YGJfPZx7pB7jln 8kCey.m4a", cAlternateFileName="YGJFPZ~1.M4A")) returned 0 [0073.958] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0073.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0073.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0073.959] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD", lpFilePart=0x0) returned 0x1f [0073.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0073.959] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD", lpFilePart=0x0) returned 0x1f [0073.959] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84af5110, ftCreationTime.dwHighDateTime=0x1d62838, ftLastAccessTime.dwLowDateTime=0xdcf14590, ftLastAccessTime.dwHighDateTime=0x1d62ff9, ftLastWriteTime.dwLowDateTime=0xdcf14590, ftLastWriteTime.dwHighDateTime=0x1d62ff9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1548 [0073.959] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84af5110, ftCreationTime.dwHighDateTime=0x1d62838, ftLastAccessTime.dwLowDateTime=0xdcf14590, ftLastAccessTime.dwHighDateTime=0x1d62ff9, ftLastWriteTime.dwLowDateTime=0xdcf14590, ftLastWriteTime.dwHighDateTime=0x1d62ff9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.959] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3d6d260, ftCreationTime.dwHighDateTime=0x1d62b46, ftLastAccessTime.dwLowDateTime=0xb2a21190, ftLastAccessTime.dwHighDateTime=0x1d62660, ftLastWriteTime.dwLowDateTime=0xb2a21190, ftLastWriteTime.dwHighDateTime=0x1d62660, nFileSizeHigh=0x0, nFileSizeLow=0x11fae, dwReserved0=0x0, dwReserved1=0x0, cFileName="-9wR.m4a", cAlternateFileName="")) returned 1 [0073.959] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6de6540, ftCreationTime.dwHighDateTime=0x1d63009, ftLastAccessTime.dwLowDateTime=0x42402d00, ftLastAccessTime.dwHighDateTime=0x1d62503, ftLastWriteTime.dwLowDateTime=0x42402d00, ftLastWriteTime.dwHighDateTime=0x1d62503, nFileSizeHigh=0x0, nFileSizeLow=0xf761, dwReserved0=0x0, dwReserved1=0x0, cFileName="-AHyKvO5.wav", cAlternateFileName="")) returned 1 [0073.959] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d26e500, ftCreationTime.dwHighDateTime=0x1d62559, ftLastAccessTime.dwLowDateTime=0x64fbd100, ftLastAccessTime.dwHighDateTime=0x1d62706, ftLastWriteTime.dwLowDateTime=0x64fbd100, ftLastWriteTime.dwHighDateTime=0x1d62706, nFileSizeHigh=0x0, nFileSizeLow=0xaa81, dwReserved0=0x0, dwReserved1=0x0, cFileName="0xbNxSRIKkoGt0.m4a", cAlternateFileName="0XBNXS~1.M4A")) returned 1 [0073.959] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16b9160, ftCreationTime.dwHighDateTime=0x1d62dae, ftLastAccessTime.dwLowDateTime=0x43160470, ftLastAccessTime.dwHighDateTime=0x1d62ab2, ftLastWriteTime.dwLowDateTime=0x43160470, ftLastWriteTime.dwHighDateTime=0x1d62ab2, nFileSizeHigh=0x0, nFileSizeLow=0x18fca, dwReserved0=0x0, dwReserved1=0x0, cFileName="1F8H2Oyjz.m4a", cAlternateFileName="1F8H2O~1.M4A")) returned 1 [0073.959] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5442e60, ftCreationTime.dwHighDateTime=0x1d628be, ftLastAccessTime.dwLowDateTime=0x75927090, ftLastAccessTime.dwHighDateTime=0x1d6239c, ftLastWriteTime.dwLowDateTime=0x75927090, ftLastWriteTime.dwHighDateTime=0x1d6239c, nFileSizeHigh=0x0, nFileSizeLow=0x14d3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="3jdCV3FfP0Fvd45brAY0.wav", cAlternateFileName="3JDCV3~1.WAV")) returned 1 [0073.959] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf97efc50, ftCreationTime.dwHighDateTime=0x1d62a1f, ftLastAccessTime.dwLowDateTime=0xdfb50cb0, ftLastAccessTime.dwHighDateTime=0x1d62736, ftLastWriteTime.dwLowDateTime=0xdfb50cb0, ftLastWriteTime.dwHighDateTime=0x1d62736, nFileSizeHigh=0x0, nFileSizeLow=0x2548, dwReserved0=0x0, dwReserved1=0x0, cFileName="49ob3DT7OAvawJMoN_.wav", cAlternateFileName="49OB3D~1.WAV")) returned 1 [0073.960] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed880c0, ftCreationTime.dwHighDateTime=0x1d62d55, ftLastAccessTime.dwLowDateTime=0xedd129e0, ftLastAccessTime.dwHighDateTime=0x1d6231d, ftLastWriteTime.dwLowDateTime=0xedd129e0, ftLastWriteTime.dwHighDateTime=0x1d6231d, nFileSizeHigh=0x0, nFileSizeLow=0x13a6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="6KK4DRSLtENL8.m4a", cAlternateFileName="6KK4DR~1.M4A")) returned 1 [0073.960] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c806be0, ftCreationTime.dwHighDateTime=0x1d627c9, ftLastAccessTime.dwLowDateTime=0xbe763470, ftLastAccessTime.dwHighDateTime=0x1d63046, ftLastWriteTime.dwLowDateTime=0xbe763470, ftLastWriteTime.dwHighDateTime=0x1d63046, nFileSizeHigh=0x0, nFileSizeLow=0x17ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="7SZQetfN6S.m4a", cAlternateFileName="7SZQET~1.M4A")) returned 1 [0073.960] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99508350, ftCreationTime.dwHighDateTime=0x1d622d4, ftLastAccessTime.dwLowDateTime=0x2b14f80, ftLastAccessTime.dwHighDateTime=0x1d62b24, ftLastWriteTime.dwLowDateTime=0x2b14f80, ftLastWriteTime.dwHighDateTime=0x1d62b24, nFileSizeHigh=0x0, nFileSizeLow=0xed8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MxaNX-T.wav", cAlternateFileName="")) returned 1 [0073.960] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbbbc4e0, ftCreationTime.dwHighDateTime=0x1d631f2, ftLastAccessTime.dwLowDateTime=0x88eff9e0, ftLastAccessTime.dwHighDateTime=0x1d62a5a, ftLastWriteTime.dwLowDateTime=0x88eff9e0, ftLastWriteTime.dwHighDateTime=0x1d62a5a, nFileSizeHigh=0x0, nFileSizeLow=0x5408, dwReserved0=0x0, dwReserved1=0x0, cFileName="OZUKUX4HXSNGJTT1u.m4a", cAlternateFileName="OZUKUX~1.M4A")) returned 1 [0073.960] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb86290, ftCreationTime.dwHighDateTime=0x1d62a5c, ftLastAccessTime.dwLowDateTime=0xb19290, ftLastAccessTime.dwHighDateTime=0x1d62c0e, ftLastWriteTime.dwLowDateTime=0xb19290, ftLastWriteTime.dwHighDateTime=0x1d62c0e, nFileSizeHigh=0x0, nFileSizeLow=0x75df, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucvLkN2VDwEe3.wav", cAlternateFileName="UCVLKN~1.WAV")) returned 1 [0073.960] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14983f30, ftCreationTime.dwHighDateTime=0x1d627ee, ftLastAccessTime.dwLowDateTime=0x5df96800, ftLastAccessTime.dwHighDateTime=0x1d63088, ftLastWriteTime.dwLowDateTime=0x5df96800, ftLastWriteTime.dwHighDateTime=0x1d63088, nFileSizeHigh=0x0, nFileSizeLow=0x10adc, dwReserved0=0x0, dwReserved1=0x0, cFileName="x1fftpT2U.m4a", cAlternateFileName="X1FFTP~1.M4A")) returned 1 [0073.960] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bb0d00, ftCreationTime.dwHighDateTime=0x1d62731, ftLastAccessTime.dwLowDateTime=0xbe4a2df0, ftLastAccessTime.dwHighDateTime=0x1d62d7e, ftLastWriteTime.dwLowDateTime=0xbe4a2df0, ftLastWriteTime.dwHighDateTime=0x1d62d7e, nFileSizeHigh=0x0, nFileSizeLow=0x16f41, dwReserved0=0x0, dwReserved1=0x0, cFileName="ylm8veo3dy0t1x-D7t.m4a", cAlternateFileName="YLM8VE~1.M4A")) returned 1 [0073.960] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777971f0, ftCreationTime.dwHighDateTime=0x1d6282f, ftLastAccessTime.dwLowDateTime=0x2b9bcb00, ftLastAccessTime.dwHighDateTime=0x1d631aa, ftLastWriteTime.dwLowDateTime=0x2b9bcb00, ftLastWriteTime.dwHighDateTime=0x1d631aa, nFileSizeHigh=0x0, nFileSizeLow=0xf40e, dwReserved0=0x0, dwReserved1=0x0, cFileName="yu8E_e6SuwkbBM.mp3", cAlternateFileName="YU8E_E~1.MP3")) returned 1 [0073.960] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.960] FindClose (in: hFindFile=0xac1548 | out: hFindFile=0xac1548) returned 1 [0073.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0073.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0073.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav", lpFilePart=0x0) returned 0x2c [0073.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0073.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\-ahykvo5.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0073.961] GetFileType (hFile=0x2d0) returned 0x1 [0073.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0073.961] GetFileType (hFile=0x2d0) returned 0x1 [0073.961] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xf761 [0073.961] ReadFile (in: hFile=0x2d0, lpBuffer=0x28aa7b4, nNumberOfBytesToRead=0xf761, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28aa7b4*, lpNumberOfBytesRead=0x8fe75c*=0xf761, lpOverlapped=0x0) returned 1 [0073.961] CloseHandle (hObject=0x2d0) returned 1 [0074.049] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav", lpFilePart=0x0) returned 0x2c [0074.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0074.049] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\-ahykvo5.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.050] GetFileType (hFile=0x2d0) returned 0x1 [0074.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0074.050] GetFileType (hFile=0x2d0) returned 0x1 [0074.050] WriteFile (in: hFile=0x2d0, lpBuffer=0x2710b94*, nNumberOfBytesToWrite=0xf770, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2710b94*, lpNumberOfBytesWritten=0x8fe74c*=0xf770, lpOverlapped=0x0) returned 1 [0074.052] CloseHandle (hObject=0x2d0) returned 1 [0074.054] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav", lpFilePart=0x0) returned 0x2c [0074.054] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0074.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0074.054] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\-ahykvo5.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6de6540, ftCreationTime.dwHighDateTime=0x1d63009, ftLastAccessTime.dwLowDateTime=0x42402d00, ftLastAccessTime.dwHighDateTime=0x1d62503, ftLastWriteTime.dwLowDateTime=0x88318927, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf770)) returned 1 [0074.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0074.054] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\-ahykvo5.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\-AHyKvO5.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\-ahykvo5.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0074.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav", lpFilePart=0x0) returned 0x38 [0074.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0074.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\3jdcv3ffp0fvd45bray0.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.055] GetFileType (hFile=0x2d0) returned 0x1 [0074.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0074.055] GetFileType (hFile=0x2d0) returned 0x1 [0074.055] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x14d3e [0074.056] ReadFile (in: hFile=0x2d0, lpBuffer=0x3956da8, nNumberOfBytesToRead=0x14d3e, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x3956da8*, lpNumberOfBytesRead=0x8fe75c*=0x14d3e, lpOverlapped=0x0) returned 1 [0074.057] CloseHandle (hObject=0x2d0) returned 1 [0074.176] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav", lpFilePart=0x0) returned 0x38 [0074.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0074.176] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\3jdcv3ffp0fvd45bray0.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.177] GetFileType (hFile=0x2d0) returned 0x1 [0074.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0074.177] GetFileType (hFile=0x2d0) returned 0x1 [0074.177] WriteFile (in: hFile=0x2d0, lpBuffer=0x39bf028*, nNumberOfBytesToWrite=0x14d40, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x39bf028*, lpNumberOfBytesWritten=0x8fe74c*=0x14d40, lpOverlapped=0x0) returned 1 [0074.178] CloseHandle (hObject=0x2d0) returned 1 [0074.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav", lpFilePart=0x0) returned 0x38 [0074.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x63 [0074.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0074.181] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\3jdcv3ffp0fvd45bray0.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5442e60, ftCreationTime.dwHighDateTime=0x1d628be, ftLastAccessTime.dwLowDateTime=0x75927090, ftLastAccessTime.dwHighDateTime=0x1d6239c, ftLastWriteTime.dwLowDateTime=0x8844a2db, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x14d40)) returned 1 [0074.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0074.181] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\3jdcv3ffp0fvd45bray0.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\3jdCV3FfP0Fvd45brAY0.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\3jdcv3ffp0fvd45bray0.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0074.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav", lpFilePart=0x0) returned 0x36 [0074.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0074.182] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\49ob3dt7oavawjmon_.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.182] GetFileType (hFile=0x2d0) returned 0x1 [0074.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0074.182] GetFileType (hFile=0x2d0) returned 0x1 [0074.182] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x2548 [0074.182] ReadFile (in: hFile=0x2d0, lpBuffer=0x276dba0, nNumberOfBytesToRead=0x2548, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x276dba0*, lpNumberOfBytesRead=0x8fe75c*=0x2548, lpOverlapped=0x0) returned 1 [0074.182] CloseHandle (hObject=0x2d0) returned 1 [0074.199] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav", lpFilePart=0x0) returned 0x36 [0074.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0074.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\49ob3dt7oavawjmon_.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.200] GetFileType (hFile=0x2d0) returned 0x1 [0074.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0074.200] GetFileType (hFile=0x2d0) returned 0x1 [0074.200] WriteFile (in: hFile=0x2d0, lpBuffer=0x27c6430*, nNumberOfBytesToWrite=0x2550, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27c6430*, lpNumberOfBytesWritten=0x8fe74c*=0x2550, lpOverlapped=0x0) returned 1 [0074.201] CloseHandle (hObject=0x2d0) returned 1 [0074.201] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav", lpFilePart=0x0) returned 0x36 [0074.201] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x61 [0074.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0074.201] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\49ob3dt7oavawjmon_.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf97efc50, ftCreationTime.dwHighDateTime=0x1d62a1f, ftLastAccessTime.dwLowDateTime=0xdfb50cb0, ftLastAccessTime.dwHighDateTime=0x1d62736, ftLastWriteTime.dwLowDateTime=0x88470015, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2550)) returned 1 [0074.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0074.202] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\49ob3dt7oavawjmon_.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\49ob3DT7OAvawJMoN_.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\49ob3dt7oavawjmon_.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0074.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav", lpFilePart=0x0) returned 0x2b [0074.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0074.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\mxanx-t.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.202] GetFileType (hFile=0x2d0) returned 0x1 [0074.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0074.203] GetFileType (hFile=0x2d0) returned 0x1 [0074.203] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xed8f [0074.203] ReadFile (in: hFile=0x2d0, lpBuffer=0x27c8e28, nNumberOfBytesToRead=0xed8f, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x27c8e28*, lpNumberOfBytesRead=0x8fe75c*=0xed8f, lpOverlapped=0x0) returned 1 [0074.203] CloseHandle (hObject=0x2d0) returned 1 [0074.306] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav", lpFilePart=0x0) returned 0x2b [0074.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0074.306] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\mxanx-t.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.307] GetFileType (hFile=0x2d0) returned 0x1 [0074.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0074.307] GetFileType (hFile=0x2d0) returned 0x1 [0074.307] WriteFile (in: hFile=0x2d0, lpBuffer=0x26fbac8*, nNumberOfBytesToWrite=0xed90, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x26fbac8*, lpNumberOfBytesWritten=0x8fe74c*=0xed90, lpOverlapped=0x0) returned 1 [0074.308] CloseHandle (hObject=0x2d0) returned 1 [0074.310] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav", lpFilePart=0x0) returned 0x2b [0074.310] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x56 [0074.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0074.310] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\mxanx-t.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99508350, ftCreationTime.dwHighDateTime=0x1d622d4, ftLastAccessTime.dwLowDateTime=0x2b14f80, ftLastAccessTime.dwHighDateTime=0x1d62b24, ftLastWriteTime.dwLowDateTime=0x8857af6b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xed90)) returned 1 [0074.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0074.310] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\mxanx-t.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\MxaNX-T.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\mxanx-t.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0074.311] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav", lpFilePart=0x0) returned 0x31 [0074.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0074.311] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\ucvlkn2vdwee3.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.311] GetFileType (hFile=0x2d0) returned 0x1 [0074.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0074.311] GetFileType (hFile=0x2d0) returned 0x1 [0074.311] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x75df [0074.311] ReadFile (in: hFile=0x2d0, lpBuffer=0x270ac90, nNumberOfBytesToRead=0x75df, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x270ac90*, lpNumberOfBytesRead=0x8fe75c*=0x75df, lpOverlapped=0x0) returned 1 [0074.311] CloseHandle (hObject=0x2d0) returned 1 [0074.403] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav", lpFilePart=0x0) returned 0x31 [0074.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0074.404] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\ucvlkn2vdwee3.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.404] GetFileType (hFile=0x2d0) returned 0x1 [0074.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0074.404] GetFileType (hFile=0x2d0) returned 0x1 [0074.405] WriteFile (in: hFile=0x2d0, lpBuffer=0x277c950*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x277c950*, lpNumberOfBytesWritten=0x8fe74c*=0x75e0, lpOverlapped=0x0) returned 1 [0074.405] CloseHandle (hObject=0x2d0) returned 1 [0074.407] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav", lpFilePart=0x0) returned 0x31 [0074.407] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5c [0074.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0074.407] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\ucvlkn2vdwee3.wav"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb86290, ftCreationTime.dwHighDateTime=0x1d62a5c, ftLastAccessTime.dwLowDateTime=0xb19290, ftLastAccessTime.dwHighDateTime=0x1d62c0e, ftLastWriteTime.dwLowDateTime=0x8865fd6b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x75e0)) returned 1 [0074.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0074.407] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\ucvlkn2vdwee3.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\ucvLkN2VDwEe3.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\ucvlkn2vdwee3.wav.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0074.407] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3", lpFilePart=0x0) returned 0x32 [0074.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0074.407] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\yu8e_e6suwkbbm.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.408] GetFileType (hFile=0x2d0) returned 0x1 [0074.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0074.408] GetFileType (hFile=0x2d0) returned 0x1 [0074.408] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xf40e [0074.457] ReadFile (in: hFile=0x2d0, lpBuffer=0x27843c4, nNumberOfBytesToRead=0xf40e, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x27843c4*, lpNumberOfBytesRead=0x8fe75c*=0xf40e, lpOverlapped=0x0) returned 1 [0074.457] CloseHandle (hObject=0x2d0) returned 1 [0074.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3", lpFilePart=0x0) returned 0x32 [0074.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0074.475] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\yu8e_e6suwkbbm.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.476] GetFileType (hFile=0x2d0) returned 0x1 [0074.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0074.476] GetFileType (hFile=0x2d0) returned 0x1 [0074.476] WriteFile (in: hFile=0x2d0, lpBuffer=0x27fee0c*, nNumberOfBytesToWrite=0xf410, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27fee0c*, lpNumberOfBytesWritten=0x8fe74c*=0xf410, lpOverlapped=0x0) returned 1 [0074.477] CloseHandle (hObject=0x2d0) returned 1 [0074.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3", lpFilePart=0x0) returned 0x32 [0074.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5d [0074.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0074.479] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\yu8e_e6suwkbbm.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777971f0, ftCreationTime.dwHighDateTime=0x1d6282f, ftLastAccessTime.dwLowDateTime=0x2b9bcb00, ftLastAccessTime.dwHighDateTime=0x1d631aa, ftLastWriteTime.dwLowDateTime=0x8871ea05, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf410)) returned 1 [0074.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0074.479] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\yu8e_e6suwkbbm.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\yu8E_e6SuwkbBM.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\music\\kxkdz_ztd\\yu8e_e6suwkbbm.mp3.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0074.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0074.480] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD", lpFilePart=0x0) returned 0x1f [0074.480] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KxKDZ_zTD\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84af5110, ftCreationTime.dwHighDateTime=0x1d62838, ftLastAccessTime.dwLowDateTime=0x8871ea05, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8871ea05, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0074.480] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84af5110, ftCreationTime.dwHighDateTime=0x1d62838, ftLastAccessTime.dwLowDateTime=0x8871ea05, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8871ea05, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.480] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3d6d260, ftCreationTime.dwHighDateTime=0x1d62b46, ftLastAccessTime.dwLowDateTime=0xb2a21190, ftLastAccessTime.dwHighDateTime=0x1d62660, ftLastWriteTime.dwLowDateTime=0xb2a21190, ftLastWriteTime.dwHighDateTime=0x1d62660, nFileSizeHigh=0x0, nFileSizeLow=0x11fae, dwReserved0=0x0, dwReserved1=0x0, cFileName="-9wR.m4a", cAlternateFileName="")) returned 1 [0074.480] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6de6540, ftCreationTime.dwHighDateTime=0x1d63009, ftLastAccessTime.dwLowDateTime=0x42402d00, ftLastAccessTime.dwHighDateTime=0x1d62503, ftLastWriteTime.dwLowDateTime=0x88318927, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf770, dwReserved0=0x0, dwReserved1=0x0, cFileName="-AHyKvO5.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="-AHYKV~1.MAD")) returned 1 [0074.480] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d26e500, ftCreationTime.dwHighDateTime=0x1d62559, ftLastAccessTime.dwLowDateTime=0x64fbd100, ftLastAccessTime.dwHighDateTime=0x1d62706, ftLastWriteTime.dwLowDateTime=0x64fbd100, ftLastWriteTime.dwHighDateTime=0x1d62706, nFileSizeHigh=0x0, nFileSizeLow=0xaa81, dwReserved0=0x0, dwReserved1=0x0, cFileName="0xbNxSRIKkoGt0.m4a", cAlternateFileName="0XBNXS~1.M4A")) returned 1 [0074.480] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16b9160, ftCreationTime.dwHighDateTime=0x1d62dae, ftLastAccessTime.dwLowDateTime=0x43160470, ftLastAccessTime.dwHighDateTime=0x1d62ab2, ftLastWriteTime.dwLowDateTime=0x43160470, ftLastWriteTime.dwHighDateTime=0x1d62ab2, nFileSizeHigh=0x0, nFileSizeLow=0x18fca, dwReserved0=0x0, dwReserved1=0x0, cFileName="1F8H2Oyjz.m4a", cAlternateFileName="1F8H2O~1.M4A")) returned 1 [0074.480] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5442e60, ftCreationTime.dwHighDateTime=0x1d628be, ftLastAccessTime.dwLowDateTime=0x75927090, ftLastAccessTime.dwHighDateTime=0x1d6239c, ftLastWriteTime.dwLowDateTime=0x8844a2db, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x14d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="3jdCV3FfP0Fvd45brAY0.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="3JDCV3~1.MAD")) returned 1 [0074.480] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf97efc50, ftCreationTime.dwHighDateTime=0x1d62a1f, ftLastAccessTime.dwLowDateTime=0xdfb50cb0, ftLastAccessTime.dwHighDateTime=0x1d62736, ftLastWriteTime.dwLowDateTime=0x88470015, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2550, dwReserved0=0x0, dwReserved1=0x0, cFileName="49ob3DT7OAvawJMoN_.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="49OB3D~1.MAD")) returned 1 [0074.481] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed880c0, ftCreationTime.dwHighDateTime=0x1d62d55, ftLastAccessTime.dwLowDateTime=0xedd129e0, ftLastAccessTime.dwHighDateTime=0x1d6231d, ftLastWriteTime.dwLowDateTime=0xedd129e0, ftLastWriteTime.dwHighDateTime=0x1d6231d, nFileSizeHigh=0x0, nFileSizeLow=0x13a6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="6KK4DRSLtENL8.m4a", cAlternateFileName="6KK4DR~1.M4A")) returned 1 [0074.481] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c806be0, ftCreationTime.dwHighDateTime=0x1d627c9, ftLastAccessTime.dwLowDateTime=0xbe763470, ftLastAccessTime.dwHighDateTime=0x1d63046, ftLastWriteTime.dwLowDateTime=0xbe763470, ftLastWriteTime.dwHighDateTime=0x1d63046, nFileSizeHigh=0x0, nFileSizeLow=0x17ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="7SZQetfN6S.m4a", cAlternateFileName="7SZQET~1.M4A")) returned 1 [0074.481] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99508350, ftCreationTime.dwHighDateTime=0x1d622d4, ftLastAccessTime.dwLowDateTime=0x2b14f80, ftLastAccessTime.dwHighDateTime=0x1d62b24, ftLastWriteTime.dwLowDateTime=0x8857af6b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="MxaNX-T.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="MXANX-~1.MAD")) returned 1 [0074.481] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbbbc4e0, ftCreationTime.dwHighDateTime=0x1d631f2, ftLastAccessTime.dwLowDateTime=0x88eff9e0, ftLastAccessTime.dwHighDateTime=0x1d62a5a, ftLastWriteTime.dwLowDateTime=0x88eff9e0, ftLastWriteTime.dwHighDateTime=0x1d62a5a, nFileSizeHigh=0x0, nFileSizeLow=0x5408, dwReserved0=0x0, dwReserved1=0x0, cFileName="OZUKUX4HXSNGJTT1u.m4a", cAlternateFileName="OZUKUX~1.M4A")) returned 1 [0074.481] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb86290, ftCreationTime.dwHighDateTime=0x1d62a5c, ftLastAccessTime.dwLowDateTime=0xb19290, ftLastAccessTime.dwHighDateTime=0x1d62c0e, ftLastWriteTime.dwLowDateTime=0x8865fd6b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x75e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucvLkN2VDwEe3.wav.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UCVLKN~1.MAD")) returned 1 [0074.481] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14983f30, ftCreationTime.dwHighDateTime=0x1d627ee, ftLastAccessTime.dwLowDateTime=0x5df96800, ftLastAccessTime.dwHighDateTime=0x1d63088, ftLastWriteTime.dwLowDateTime=0x5df96800, ftLastWriteTime.dwHighDateTime=0x1d63088, nFileSizeHigh=0x0, nFileSizeLow=0x10adc, dwReserved0=0x0, dwReserved1=0x0, cFileName="x1fftpT2U.m4a", cAlternateFileName="X1FFTP~1.M4A")) returned 1 [0074.481] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bb0d00, ftCreationTime.dwHighDateTime=0x1d62731, ftLastAccessTime.dwLowDateTime=0xbe4a2df0, ftLastAccessTime.dwHighDateTime=0x1d62d7e, ftLastWriteTime.dwLowDateTime=0xbe4a2df0, ftLastWriteTime.dwHighDateTime=0x1d62d7e, nFileSizeHigh=0x0, nFileSizeLow=0x16f41, dwReserved0=0x0, dwReserved1=0x0, cFileName="ylm8veo3dy0t1x-D7t.m4a", cAlternateFileName="YLM8VE~1.M4A")) returned 1 [0074.481] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777971f0, ftCreationTime.dwHighDateTime=0x1d6282f, ftLastAccessTime.dwLowDateTime=0x2b9bcb00, ftLastAccessTime.dwHighDateTime=0x1d631aa, ftLastWriteTime.dwLowDateTime=0x8871ea05, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf410, dwReserved0=0x0, dwReserved1=0x0, cFileName="yu8E_e6SuwkbBM.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="YU8E_E~1.MAD")) returned 1 [0074.481] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777971f0, ftCreationTime.dwHighDateTime=0x1d6282f, ftLastAccessTime.dwLowDateTime=0x2b9bcb00, ftLastAccessTime.dwHighDateTime=0x1d631aa, ftLastWriteTime.dwLowDateTime=0x8871ea05, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf410, dwReserved0=0x0, dwReserved1=0x0, cFileName="yu8E_e6SuwkbBM.mp3.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="YU8E_E~1.MAD")) returned 0 [0074.482] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0074.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0074.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0074.482] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18 [0074.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0074.482] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18 [0074.482] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0074.482] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.482] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.482] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.482] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0074.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0074.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0074.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0074.482] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18 [0074.482] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1208 [0074.483] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.483] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.483] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0074.483] FindClose (in: hFindFile=0xac1208 | out: hFindFile=0xac1208) returned 1 [0074.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0074.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0074.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0074.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0074.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0074.483] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf9f7d4f, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf9f7d4f, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1208 [0074.483] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf9f7d4f, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf9f7d4f, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.483] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb61b3f0, ftCreationTime.dwHighDateTime=0x1d62ede, ftLastAccessTime.dwLowDateTime=0x921cf730, ftLastAccessTime.dwHighDateTime=0x1d629f0, ftLastWriteTime.dwLowDateTime=0x921cf730, ftLastWriteTime.dwHighDateTime=0x1d629f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-6Jz6", cAlternateFileName="")) returned 1 [0074.483] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0074.484] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x479bc430, ftCreationTime.dwHighDateTime=0x1d631c4, ftLastAccessTime.dwLowDateTime=0x52aeef40, ftLastAccessTime.dwHighDateTime=0x1d6295a, ftLastWriteTime.dwLowDateTime=0x52aeef40, ftLastWriteTime.dwHighDateTime=0x1d6295a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DdDZHt od", cAlternateFileName="DDDZHT~1")) returned 1 [0074.484] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.484] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf88a6300, ftCreationTime.dwHighDateTime=0x1d63089, ftLastAccessTime.dwLowDateTime=0x9aaf99d0, ftLastAccessTime.dwHighDateTime=0x1d62e27, ftLastWriteTime.dwLowDateTime=0x9aaf99d0, ftLastWriteTime.dwHighDateTime=0x1d62e27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7 bC7VGmQwxtl6UPTSb", cAlternateFileName="E7BC7V~1")) returned 1 [0074.484] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8fbc940, ftCreationTime.dwHighDateTime=0x1d631c5, ftLastAccessTime.dwLowDateTime=0x47ad7980, ftLastAccessTime.dwHighDateTime=0x1d62c08, ftLastWriteTime.dwLowDateTime=0x47ad7980, ftLastWriteTime.dwHighDateTime=0x1d62c08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gaA14", cAlternateFileName="")) returned 1 [0074.484] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f495410, ftCreationTime.dwHighDateTime=0x1d62997, ftLastAccessTime.dwLowDateTime=0xb2e090c0, ftLastAccessTime.dwHighDateTime=0x1d6278a, ftLastWriteTime.dwLowDateTime=0xb2e090c0, ftLastWriteTime.dwHighDateTime=0x1d6278a, nFileSizeHigh=0x0, nFileSizeLow=0x79b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GmsG 1byBD-2.gif", cAlternateFileName="GMSG1B~1.GIF")) returned 1 [0074.484] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x371a9600, ftCreationTime.dwHighDateTime=0x1d6318c, ftLastAccessTime.dwLowDateTime=0xf09f5f60, ftLastAccessTime.dwHighDateTime=0x1d6246d, ftLastWriteTime.dwLowDateTime=0xf09f5f60, ftLastWriteTime.dwHighDateTime=0x1d6246d, nFileSizeHigh=0x0, nFileSizeLow=0x67ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="NKzRIDoN2P.jpg", cAlternateFileName="NKZRID~1.JPG")) returned 1 [0074.484] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe32be10, ftCreationTime.dwHighDateTime=0x1d62afc, ftLastAccessTime.dwLowDateTime=0x7ca57950, ftLastAccessTime.dwHighDateTime=0x1d630ed, ftLastWriteTime.dwLowDateTime=0x7ca57950, ftLastWriteTime.dwHighDateTime=0x1d630ed, nFileSizeHigh=0x0, nFileSizeLow=0xcac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="q_QBqZuTej.gif", cAlternateFileName="Q_QBQZ~1.GIF")) returned 1 [0074.484] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0074.484] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedadb550, ftCreationTime.dwHighDateTime=0x1d6247b, ftLastAccessTime.dwLowDateTime=0x4a7db80, ftLastAccessTime.dwHighDateTime=0x1d62325, ftLastWriteTime.dwLowDateTime=0x4a7db80, ftLastWriteTime.dwHighDateTime=0x1d62325, nFileSizeHigh=0x0, nFileSizeLow=0x6119, dwReserved0=0x0, dwReserved1=0x0, cFileName="xbZuiuv.jpg", cAlternateFileName="")) returned 1 [0074.485] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.485] FindClose (in: hFindFile=0xac1208 | out: hFindFile=0xac1208) returned 1 [0074.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0074.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0074.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif", lpFilePart=0x0) returned 0x29 [0074.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0074.485] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\gmsg 1bybd-2.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.485] GetFileType (hFile=0x2d0) returned 0x1 [0074.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0074.485] GetFileType (hFile=0x2d0) returned 0x1 [0074.485] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x79b [0074.485] ReadFile (in: hFile=0x2d0, lpBuffer=0x2812cc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2812cc4*, lpNumberOfBytesRead=0x8fe7a0*=0x79b, lpOverlapped=0x0) returned 1 [0074.485] CloseHandle (hObject=0x2d0) returned 1 [0074.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif", lpFilePart=0x0) returned 0x29 [0074.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0074.557] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\gmsg 1bybd-2.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.558] GetFileType (hFile=0x2d0) returned 0x1 [0074.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0074.558] GetFileType (hFile=0x2d0) returned 0x1 [0074.558] WriteFile (in: hFile=0x2d0, lpBuffer=0x28631e4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x28631e4*, lpNumberOfBytesWritten=0x8fe764*=0x7a0, lpOverlapped=0x0) returned 1 [0074.559] CloseHandle (hObject=0x2d0) returned 1 [0074.560] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif", lpFilePart=0x0) returned 0x29 [0074.560] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x54 [0074.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0074.560] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\gmsg 1bybd-2.gif"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f495410, ftCreationTime.dwHighDateTime=0x1d62997, ftLastAccessTime.dwLowDateTime=0xb2e090c0, ftLastAccessTime.dwHighDateTime=0x1d6278a, ftLastWriteTime.dwLowDateTime=0x887dd4f8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x7a0)) returned 1 [0074.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0074.560] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\gmsg 1bybd-2.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\GmsG 1byBD-2.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\gmsg 1bybd-2.gif.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0074.561] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg", lpFilePart=0x0) returned 0x27 [0074.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0074.561] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\nkzridon2p.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.561] GetFileType (hFile=0x2d0) returned 0x1 [0074.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0074.561] GetFileType (hFile=0x2d0) returned 0x1 [0074.561] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x67ce [0074.561] ReadFile (in: hFile=0x2d0, lpBuffer=0x28644fc, nNumberOfBytesToRead=0x67ce, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28644fc*, lpNumberOfBytesRead=0x8fe7a0*=0x67ce, lpOverlapped=0x0) returned 1 [0074.561] CloseHandle (hObject=0x2d0) returned 1 [0074.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg", lpFilePart=0x0) returned 0x27 [0074.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0074.577] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\nkzridon2p.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.578] GetFileType (hFile=0x2d0) returned 0x1 [0074.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0074.578] GetFileType (hFile=0x2d0) returned 0x1 [0074.578] WriteFile (in: hFile=0x2d0, lpBuffer=0x28d1a10*, nNumberOfBytesToWrite=0x67d0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x28d1a10*, lpNumberOfBytesWritten=0x8fe790*=0x67d0, lpOverlapped=0x0) returned 1 [0074.579] CloseHandle (hObject=0x2d0) returned 1 [0074.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg", lpFilePart=0x0) returned 0x27 [0074.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x52 [0074.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0074.583] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\nkzridon2p.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x371a9600, ftCreationTime.dwHighDateTime=0x1d6318c, ftLastAccessTime.dwLowDateTime=0xf09f5f60, ftLastAccessTime.dwHighDateTime=0x1d6246d, ftLastWriteTime.dwLowDateTime=0x8882ac6c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x67d0)) returned 1 [0074.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0074.583] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\nkzridon2p.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\NKzRIDoN2P.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\nkzridon2p.jpg.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0074.584] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif", lpFilePart=0x0) returned 0x27 [0074.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0074.584] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\q_qbqzutej.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.584] GetFileType (hFile=0x2d0) returned 0x1 [0074.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0074.584] GetFileType (hFile=0x2d0) returned 0x1 [0074.584] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xcac0 [0074.584] ReadFile (in: hFile=0x2d0, lpBuffer=0x28d85d0, nNumberOfBytesToRead=0xcac0, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28d85d0*, lpNumberOfBytesRead=0x8fe7a0*=0xcac0, lpOverlapped=0x0) returned 1 [0074.584] CloseHandle (hObject=0x2d0) returned 1 [0074.674] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif", lpFilePart=0x0) returned 0x27 [0074.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0074.674] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\q_qbqzutej.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.675] GetFileType (hFile=0x2d0) returned 0x1 [0074.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0074.675] GetFileType (hFile=0x2d0) returned 0x1 [0074.675] WriteFile (in: hFile=0x2d0, lpBuffer=0x2758730*, nNumberOfBytesToWrite=0xcad0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2758730*, lpNumberOfBytesWritten=0x8fe790*=0xcad0, lpOverlapped=0x0) returned 1 [0074.676] CloseHandle (hObject=0x2d0) returned 1 [0074.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif", lpFilePart=0x0) returned 0x27 [0074.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x52 [0074.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0074.678] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\q_qbqzutej.gif"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe32be10, ftCreationTime.dwHighDateTime=0x1d62afc, ftLastAccessTime.dwLowDateTime=0x7ca57950, ftLastAccessTime.dwHighDateTime=0x1d630ed, ftLastWriteTime.dwLowDateTime=0x8890e780, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xcad0)) returned 1 [0074.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0074.678] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\q_qbqzutej.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\q_QBqZuTej.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\q_qbqzutej.gif.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0074.679] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg", lpFilePart=0x0) returned 0x24 [0074.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0074.679] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\xbzuiuv.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.679] GetFileType (hFile=0x2d0) returned 0x1 [0074.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0074.679] GetFileType (hFile=0x2d0) returned 0x1 [0074.679] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x6119 [0074.679] ReadFile (in: hFile=0x2d0, lpBuffer=0x27655e4, nNumberOfBytesToRead=0x6119, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27655e4*, lpNumberOfBytesRead=0x8fe7a0*=0x6119, lpOverlapped=0x0) returned 1 [0074.679] CloseHandle (hObject=0x2d0) returned 1 [0074.750] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg", lpFilePart=0x0) returned 0x24 [0074.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0074.750] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\xbzuiuv.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.751] GetFileType (hFile=0x2d0) returned 0x1 [0074.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0074.751] GetFileType (hFile=0x2d0) returned 0x1 [0074.751] WriteFile (in: hFile=0x2d0, lpBuffer=0x27d0ae4*, nNumberOfBytesToWrite=0x6120, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27d0ae4*, lpNumberOfBytesWritten=0x8fe790*=0x6120, lpOverlapped=0x0) returned 1 [0074.752] CloseHandle (hObject=0x2d0) returned 1 [0074.753] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg", lpFilePart=0x0) returned 0x24 [0074.753] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4f [0074.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0074.753] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\xbzuiuv.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedadb550, ftCreationTime.dwHighDateTime=0x1d6247b, ftLastAccessTime.dwLowDateTime=0x4a7db80, ftLastAccessTime.dwHighDateTime=0x1d62325, ftLastWriteTime.dwLowDateTime=0x889cd41a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x6120)) returned 1 [0074.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0074.753] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\xbzuiuv.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\xbZuiuv.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\xbzuiuv.jpg.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0074.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0074.754] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0074.754] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x889cd41a, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x889cd41a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1248 [0074.754] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x889cd41a, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x889cd41a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.755] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb61b3f0, ftCreationTime.dwHighDateTime=0x1d62ede, ftLastAccessTime.dwLowDateTime=0x921cf730, ftLastAccessTime.dwHighDateTime=0x1d629f0, ftLastWriteTime.dwLowDateTime=0x921cf730, ftLastWriteTime.dwHighDateTime=0x1d629f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-6Jz6", cAlternateFileName="")) returned 1 [0074.755] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0074.755] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x479bc430, ftCreationTime.dwHighDateTime=0x1d631c4, ftLastAccessTime.dwLowDateTime=0x52aeef40, ftLastAccessTime.dwHighDateTime=0x1d6295a, ftLastWriteTime.dwLowDateTime=0x52aeef40, ftLastWriteTime.dwHighDateTime=0x1d6295a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DdDZHt od", cAlternateFileName="DDDZHT~1")) returned 1 [0074.755] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.755] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf88a6300, ftCreationTime.dwHighDateTime=0x1d63089, ftLastAccessTime.dwLowDateTime=0x9aaf99d0, ftLastAccessTime.dwHighDateTime=0x1d62e27, ftLastWriteTime.dwLowDateTime=0x9aaf99d0, ftLastWriteTime.dwHighDateTime=0x1d62e27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7 bC7VGmQwxtl6UPTSb", cAlternateFileName="E7BC7V~1")) returned 1 [0074.755] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8fbc940, ftCreationTime.dwHighDateTime=0x1d631c5, ftLastAccessTime.dwLowDateTime=0x47ad7980, ftLastAccessTime.dwHighDateTime=0x1d62c08, ftLastWriteTime.dwLowDateTime=0x47ad7980, ftLastWriteTime.dwHighDateTime=0x1d62c08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gaA14", cAlternateFileName="")) returned 1 [0074.755] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f495410, ftCreationTime.dwHighDateTime=0x1d62997, ftLastAccessTime.dwLowDateTime=0xb2e090c0, ftLastAccessTime.dwHighDateTime=0x1d6278a, ftLastWriteTime.dwLowDateTime=0x887dd4f8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GmsG 1byBD-2.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="GMSG1B~1.MAD")) returned 1 [0074.755] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x371a9600, ftCreationTime.dwHighDateTime=0x1d6318c, ftLastAccessTime.dwLowDateTime=0xf09f5f60, ftLastAccessTime.dwHighDateTime=0x1d6246d, ftLastWriteTime.dwLowDateTime=0x8882ac6c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x67d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NKzRIDoN2P.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="NKZRID~1.MAD")) returned 1 [0074.755] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe32be10, ftCreationTime.dwHighDateTime=0x1d62afc, ftLastAccessTime.dwLowDateTime=0x7ca57950, ftLastAccessTime.dwHighDateTime=0x1d630ed, ftLastWriteTime.dwLowDateTime=0x8890e780, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xcad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="q_QBqZuTej.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="Q_QBQZ~1.MAD")) returned 1 [0074.755] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0074.756] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedadb550, ftCreationTime.dwHighDateTime=0x1d6247b, ftLastAccessTime.dwLowDateTime=0x4a7db80, ftLastAccessTime.dwHighDateTime=0x1d62325, ftLastWriteTime.dwLowDateTime=0x889cd41a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x6120, dwReserved0=0x0, dwReserved1=0x0, cFileName="xbZuiuv.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="XBZUIU~1.MAD")) returned 1 [0074.756] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedadb550, ftCreationTime.dwHighDateTime=0x1d6247b, ftLastAccessTime.dwLowDateTime=0x4a7db80, ftLastAccessTime.dwHighDateTime=0x1d62325, ftLastWriteTime.dwLowDateTime=0x889cd41a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x6120, dwReserved0=0x0, dwReserved1=0x0, cFileName="xbZuiuv.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="XBZUIU~1.MAD")) returned 0 [0074.756] FindClose (in: hFindFile=0xac1248 | out: hFindFile=0xac1248) returned 1 [0074.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0074.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0074.756] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6", lpFilePart=0x0) returned 0x1e [0074.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0074.756] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6", lpFilePart=0x0) returned 0x1e [0074.756] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb61b3f0, ftCreationTime.dwHighDateTime=0x1d62ede, ftLastAccessTime.dwLowDateTime=0x921cf730, ftLastAccessTime.dwHighDateTime=0x1d629f0, ftLastWriteTime.dwLowDateTime=0x921cf730, ftLastWriteTime.dwHighDateTime=0x1d629f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f08 [0074.756] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb61b3f0, ftCreationTime.dwHighDateTime=0x1d62ede, ftLastAccessTime.dwLowDateTime=0x921cf730, ftLastAccessTime.dwHighDateTime=0x1d629f0, ftLastWriteTime.dwLowDateTime=0x921cf730, ftLastWriteTime.dwHighDateTime=0x1d629f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.756] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a9b320, ftCreationTime.dwHighDateTime=0x1d627ec, ftLastAccessTime.dwLowDateTime=0x69c0d8c0, ftLastAccessTime.dwHighDateTime=0x1d628eb, ftLastWriteTime.dwLowDateTime=0x69c0d8c0, ftLastWriteTime.dwHighDateTime=0x1d628eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6b1_xTualT1LLe", cAlternateFileName="6B1_XT~1")) returned 1 [0074.756] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1356f20, ftCreationTime.dwHighDateTime=0x1d629a2, ftLastAccessTime.dwLowDateTime=0xafce7fe0, ftLastAccessTime.dwHighDateTime=0x1d62a29, ftLastWriteTime.dwLowDateTime=0xafce7fe0, ftLastWriteTime.dwHighDateTime=0x1d62a29, nFileSizeHigh=0x0, nFileSizeLow=0xad47, dwReserved0=0x0, dwReserved1=0x0, cFileName="fUfJ.jpg", cAlternateFileName="")) returned 1 [0074.757] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48826be0, ftCreationTime.dwHighDateTime=0x1d62dac, ftLastAccessTime.dwLowDateTime=0xcf6adf0, ftLastAccessTime.dwHighDateTime=0x1d62af7, ftLastWriteTime.dwLowDateTime=0xcf6adf0, ftLastWriteTime.dwHighDateTime=0x1d62af7, nFileSizeHigh=0x0, nFileSizeLow=0x1156b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HruthkB4LvXR.bmp", cAlternateFileName="HRUTHK~1.BMP")) returned 1 [0074.757] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.757] FindClose (in: hFindFile=0xac0f08 | out: hFindFile=0xac0f08) returned 1 [0074.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0074.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0074.757] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg", lpFilePart=0x0) returned 0x27 [0074.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0074.757] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\fufj.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.757] GetFileType (hFile=0x2d0) returned 0x1 [0074.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0074.757] GetFileType (hFile=0x2d0) returned 0x1 [0074.757] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xad47 [0074.757] ReadFile (in: hFile=0x2d0, lpBuffer=0x27d952c, nNumberOfBytesToRead=0xad47, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x27d952c*, lpNumberOfBytesRead=0x8fe75c*=0xad47, lpOverlapped=0x0) returned 1 [0074.757] CloseHandle (hObject=0x2d0) returned 1 [0074.777] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg", lpFilePart=0x0) returned 0x27 [0074.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0074.777] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\fufj.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.778] GetFileType (hFile=0x2d0) returned 0x1 [0074.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0074.778] GetFileType (hFile=0x2d0) returned 0x1 [0074.778] WriteFile (in: hFile=0x2d0, lpBuffer=0x2846b34*, nNumberOfBytesToWrite=0xad50, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2846b34*, lpNumberOfBytesWritten=0x8fe74c*=0xad50, lpOverlapped=0x0) returned 1 [0074.779] CloseHandle (hObject=0x2d0) returned 1 [0074.780] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg", lpFilePart=0x0) returned 0x27 [0074.781] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x52 [0074.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0074.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\fufj.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1356f20, ftCreationTime.dwHighDateTime=0x1d629a2, ftLastAccessTime.dwLowDateTime=0xafce7fe0, ftLastAccessTime.dwHighDateTime=0x1d62a29, ftLastWriteTime.dwLowDateTime=0x889f3700, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xad50)) returned 1 [0074.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0074.781] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\fufj.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\fUfJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\fufj.jpg.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0074.832] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp", lpFilePart=0x0) returned 0x2f [0074.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0074.832] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\hruthkb4lvxr.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.833] GetFileType (hFile=0x2d0) returned 0x1 [0074.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0074.833] GetFileType (hFile=0x2d0) returned 0x1 [0074.833] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x1156b [0074.833] ReadFile (in: hFile=0x2d0, lpBuffer=0x2851c7c, nNumberOfBytesToRead=0x1156b, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2851c7c*, lpNumberOfBytesRead=0x8fe75c*=0x1156b, lpOverlapped=0x0) returned 1 [0074.833] CloseHandle (hObject=0x2d0) returned 1 [0074.851] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp", lpFilePart=0x0) returned 0x2f [0074.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0074.851] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\hruthkb4lvxr.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.852] GetFileType (hFile=0x2d0) returned 0x1 [0074.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0074.852] GetFileType (hFile=0x2d0) returned 0x1 [0074.852] WriteFile (in: hFile=0x2d0, lpBuffer=0x28d2ae4*, nNumberOfBytesToWrite=0x11570, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28d2ae4*, lpNumberOfBytesWritten=0x8fe74c*=0x11570, lpOverlapped=0x0) returned 1 [0074.853] CloseHandle (hObject=0x2d0) returned 1 [0074.855] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp", lpFilePart=0x0) returned 0x2f [0074.855] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5a [0074.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0074.855] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\hruthkb4lvxr.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48826be0, ftCreationTime.dwHighDateTime=0x1d62dac, ftLastAccessTime.dwLowDateTime=0xcf6adf0, ftLastAccessTime.dwHighDateTime=0x1d62af7, ftLastWriteTime.dwLowDateTime=0x88ab2249, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11570)) returned 1 [0074.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0074.855] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\hruthkb4lvxr.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\HruthkB4LvXR.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\hruthkb4lvxr.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0074.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0074.856] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6", lpFilePart=0x0) returned 0x1e [0074.856] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb61b3f0, ftCreationTime.dwHighDateTime=0x1d62ede, ftLastAccessTime.dwLowDateTime=0x88ab2249, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x88ab2249, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0074.856] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb61b3f0, ftCreationTime.dwHighDateTime=0x1d62ede, ftLastAccessTime.dwLowDateTime=0x88ab2249, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x88ab2249, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.856] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a9b320, ftCreationTime.dwHighDateTime=0x1d627ec, ftLastAccessTime.dwLowDateTime=0x69c0d8c0, ftLastAccessTime.dwHighDateTime=0x1d628eb, ftLastWriteTime.dwLowDateTime=0x69c0d8c0, ftLastWriteTime.dwHighDateTime=0x1d628eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6b1_xTualT1LLe", cAlternateFileName="6B1_XT~1")) returned 1 [0074.856] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1356f20, ftCreationTime.dwHighDateTime=0x1d629a2, ftLastAccessTime.dwLowDateTime=0xafce7fe0, ftLastAccessTime.dwHighDateTime=0x1d62a29, ftLastWriteTime.dwLowDateTime=0x889f3700, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xad50, dwReserved0=0x0, dwReserved1=0x0, cFileName="fUfJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="FUFJJP~1.MAD")) returned 1 [0074.856] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48826be0, ftCreationTime.dwHighDateTime=0x1d62dac, ftLastAccessTime.dwLowDateTime=0xcf6adf0, ftLastAccessTime.dwHighDateTime=0x1d62af7, ftLastWriteTime.dwLowDateTime=0x88ab2249, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11570, dwReserved0=0x0, dwReserved1=0x0, cFileName="HruthkB4LvXR.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HRUTHK~1.MAD")) returned 1 [0074.857] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48826be0, ftCreationTime.dwHighDateTime=0x1d62dac, ftLastAccessTime.dwLowDateTime=0xcf6adf0, ftLastAccessTime.dwHighDateTime=0x1d62af7, ftLastWriteTime.dwLowDateTime=0x88ab2249, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11570, dwReserved0=0x0, dwReserved1=0x0, cFileName="HruthkB4LvXR.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HRUTHK~1.MAD")) returned 0 [0074.857] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0074.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0074.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0074.857] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe", nBufferLength=0x105, lpBuffer=0x8fe250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe", lpFilePart=0x0) returned 0x2d [0074.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0074.857] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe", lpFilePart=0x0) returned 0x2d [0074.857] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a9b320, ftCreationTime.dwHighDateTime=0x1d627ec, ftLastAccessTime.dwLowDateTime=0x69c0d8c0, ftLastAccessTime.dwHighDateTime=0x1d628eb, ftLastWriteTime.dwLowDateTime=0x69c0d8c0, ftLastWriteTime.dwHighDateTime=0x1d628eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f88 [0074.857] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a9b320, ftCreationTime.dwHighDateTime=0x1d627ec, ftLastAccessTime.dwLowDateTime=0x69c0d8c0, ftLastAccessTime.dwHighDateTime=0x1d628eb, ftLastWriteTime.dwLowDateTime=0x69c0d8c0, ftLastWriteTime.dwHighDateTime=0x1d628eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.857] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e79b650, ftCreationTime.dwHighDateTime=0x1d624db, ftLastAccessTime.dwLowDateTime=0x56800500, ftLastAccessTime.dwHighDateTime=0x1d62dfb, ftLastWriteTime.dwLowDateTime=0x56800500, ftLastWriteTime.dwHighDateTime=0x1d62dfb, nFileSizeHigh=0x0, nFileSizeLow=0xfd07, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C9sDHBA.gif", cAlternateFileName="")) returned 1 [0074.857] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd030f30, ftCreationTime.dwHighDateTime=0x1d62a48, ftLastAccessTime.dwLowDateTime=0x723c4f00, ftLastAccessTime.dwHighDateTime=0x1d628f2, ftLastWriteTime.dwLowDateTime=0x723c4f00, ftLastWriteTime.dwHighDateTime=0x1d628f2, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x0, dwReserved1=0x0, cFileName="5mE9JZjto.bmp", cAlternateFileName="5ME9JZ~1.BMP")) returned 1 [0074.857] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd82e99d0, ftCreationTime.dwHighDateTime=0x1d62537, ftLastAccessTime.dwLowDateTime=0x3ad38a70, ftLastAccessTime.dwHighDateTime=0x1d62d1a, ftLastWriteTime.dwLowDateTime=0x3ad38a70, ftLastWriteTime.dwHighDateTime=0x1d62d1a, nFileSizeHigh=0x0, nFileSizeLow=0x18858, dwReserved0=0x0, dwReserved1=0x0, cFileName="6tg-fHA2Ocuy.png", cAlternateFileName="6TG-FH~1.PNG")) returned 1 [0074.858] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf902b0, ftCreationTime.dwHighDateTime=0x1d62795, ftLastAccessTime.dwLowDateTime=0xcacc9670, ftLastAccessTime.dwHighDateTime=0x1d631b7, ftLastWriteTime.dwLowDateTime=0xcacc9670, ftLastWriteTime.dwHighDateTime=0x1d631b7, nFileSizeHigh=0x0, nFileSizeLow=0x246f, dwReserved0=0x0, dwReserved1=0x0, cFileName="O3_fQ.gif", cAlternateFileName="")) returned 1 [0074.858] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda59eb0, ftCreationTime.dwHighDateTime=0x1d62605, ftLastAccessTime.dwLowDateTime=0x982002d0, ftLastAccessTime.dwHighDateTime=0x1d6302b, ftLastWriteTime.dwLowDateTime=0x982002d0, ftLastWriteTime.dwHighDateTime=0x1d6302b, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNpZ5A8.gif", cAlternateFileName="")) returned 1 [0074.858] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc71c390, ftCreationTime.dwHighDateTime=0x1d63131, ftLastAccessTime.dwLowDateTime=0x94fa60b0, ftLastAccessTime.dwHighDateTime=0x1d622b5, ftLastWriteTime.dwLowDateTime=0x94fa60b0, ftLastWriteTime.dwHighDateTime=0x1d622b5, nFileSizeHigh=0x0, nFileSizeLow=0x12ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_-aql0Eac_rt.bmp", cAlternateFileName="_-AQL0~1.BMP")) returned 1 [0074.858] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.858] FindClose (in: hFindFile=0xac0f88 | out: hFindFile=0xac0f88) returned 1 [0074.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0074.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0074.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif", lpFilePart=0x0) returned 0x3a [0074.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0074.858] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\2c9sdhba.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.858] GetFileType (hFile=0x2d0) returned 0x1 [0074.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0074.858] GetFileType (hFile=0x2d0) returned 0x1 [0074.858] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0xfd07 [0074.858] ReadFile (in: hFile=0x2d0, lpBuffer=0x28e64c4, nNumberOfBytesToRead=0xfd07, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x28e64c4*, lpNumberOfBytesRead=0x8fe718*=0xfd07, lpOverlapped=0x0) returned 1 [0074.859] CloseHandle (hObject=0x2d0) returned 1 [0074.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif", lpFilePart=0x0) returned 0x3a [0074.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0074.949] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\2c9sdhba.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0074.950] GetFileType (hFile=0x2d0) returned 0x1 [0074.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0074.950] GetFileType (hFile=0x2d0) returned 0x1 [0074.950] WriteFile (in: hFile=0x2d0, lpBuffer=0x27736d4*, nNumberOfBytesToWrite=0xfd10, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x27736d4*, lpNumberOfBytesWritten=0x8fe708*=0xfd10, lpOverlapped=0x0) returned 1 [0075.005] CloseHandle (hObject=0x2d0) returned 1 [0075.007] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif", lpFilePart=0x0) returned 0x3a [0075.007] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x65 [0075.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0075.007] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\2c9sdhba.gif"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e79b650, ftCreationTime.dwHighDateTime=0x1d624db, ftLastAccessTime.dwLowDateTime=0x56800500, ftLastAccessTime.dwHighDateTime=0x1d62dfb, ftLastWriteTime.dwLowDateTime=0x88c2fa68, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfd10)) returned 1 [0075.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0075.007] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\2c9sdhba.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\2C9sDHBA.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\2c9sdhba.gif.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.008] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp", lpFilePart=0x0) returned 0x3b [0075.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0075.008] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\5me9jzjto.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.008] GetFileType (hFile=0x2d0) returned 0x1 [0075.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0075.008] GetFileType (hFile=0x2d0) returned 0x1 [0075.008] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x192a [0075.008] ReadFile (in: hFile=0x2d0, lpBuffer=0x278388c, nNumberOfBytesToRead=0x192a, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x278388c*, lpNumberOfBytesRead=0x8fe718*=0x192a, lpOverlapped=0x0) returned 1 [0075.008] CloseHandle (hObject=0x2d0) returned 1 [0075.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp", lpFilePart=0x0) returned 0x3b [0075.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0075.024] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\5me9jzjto.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.025] GetFileType (hFile=0x2d0) returned 0x1 [0075.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0075.025] GetFileType (hFile=0x2d0) returned 0x1 [0075.025] WriteFile (in: hFile=0x2d0, lpBuffer=0x27d85dc*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x27d85dc*, lpNumberOfBytesWritten=0x8fe708*=0x1930, lpOverlapped=0x0) returned 1 [0075.026] CloseHandle (hObject=0x2d0) returned 1 [0075.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp", lpFilePart=0x0) returned 0x3b [0075.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x66 [0075.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0075.027] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\5me9jzjto.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd030f30, ftCreationTime.dwHighDateTime=0x1d62a48, ftLastAccessTime.dwLowDateTime=0x723c4f00, ftLastAccessTime.dwHighDateTime=0x1d628f2, ftLastWriteTime.dwLowDateTime=0x88c55c17, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1930)) returned 1 [0075.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0075.027] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\5me9jzjto.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\5mE9JZjto.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\5me9jzjto.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png", lpFilePart=0x0) returned 0x3e [0075.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0075.028] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\6tg-fha2ocuy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.028] GetFileType (hFile=0x2d0) returned 0x1 [0075.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0075.028] GetFileType (hFile=0x2d0) returned 0x1 [0075.029] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x18858 [0075.029] ReadFile (in: hFile=0x2d0, lpBuffer=0x3777168, nNumberOfBytesToRead=0x18858, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x3777168*, lpNumberOfBytesRead=0x8fe718*=0x18858, lpOverlapped=0x0) returned 1 [0075.030] CloseHandle (hObject=0x2d0) returned 1 [0075.154] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png", lpFilePart=0x0) returned 0x3e [0075.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0075.155] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\6tg-fha2ocuy.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.156] GetFileType (hFile=0x2d0) returned 0x1 [0075.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0075.156] GetFileType (hFile=0x2d0) returned 0x1 [0075.156] WriteFile (in: hFile=0x2d0, lpBuffer=0x37f1b80*, nNumberOfBytesToWrite=0x18860, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x37f1b80*, lpNumberOfBytesWritten=0x8fe708*=0x18860, lpOverlapped=0x0) returned 1 [0075.157] CloseHandle (hObject=0x2d0) returned 1 [0075.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png", lpFilePart=0x0) returned 0x3e [0075.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x69 [0075.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0075.160] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\6tg-fha2ocuy.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd82e99d0, ftCreationTime.dwHighDateTime=0x1d62537, ftLastAccessTime.dwLowDateTime=0x3ad38a70, ftLastAccessTime.dwHighDateTime=0x1d62d1a, ftLastWriteTime.dwLowDateTime=0x88dad08d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x18860)) returned 1 [0075.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0075.160] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\6tg-fha2ocuy.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\6tg-fHA2Ocuy.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\6tg-fha2ocuy.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.161] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif", lpFilePart=0x0) returned 0x37 [0075.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0075.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\o3_fq.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.161] GetFileType (hFile=0x2d0) returned 0x1 [0075.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0075.161] GetFileType (hFile=0x2d0) returned 0x1 [0075.161] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x246f [0075.161] ReadFile (in: hFile=0x2d0, lpBuffer=0x2827698, nNumberOfBytesToRead=0x246f, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x2827698*, lpNumberOfBytesRead=0x8fe718*=0x246f, lpOverlapped=0x0) returned 1 [0075.161] CloseHandle (hObject=0x2d0) returned 1 [0075.178] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif", lpFilePart=0x0) returned 0x37 [0075.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0075.178] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\o3_fq.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.179] GetFileType (hFile=0x2d0) returned 0x1 [0075.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0075.179] GetFileType (hFile=0x2d0) returned 0x1 [0075.179] WriteFile (in: hFile=0x2d0, lpBuffer=0x287facc*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x287facc*, lpNumberOfBytesWritten=0x8fe708*=0x2470, lpOverlapped=0x0) returned 1 [0075.179] CloseHandle (hObject=0x2d0) returned 1 [0075.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif", lpFilePart=0x0) returned 0x37 [0075.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x62 [0075.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0075.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\o3_fq.gif"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf902b0, ftCreationTime.dwHighDateTime=0x1d62795, ftLastAccessTime.dwLowDateTime=0xcacc9670, ftLastAccessTime.dwHighDateTime=0x1d631b7, ftLastWriteTime.dwLowDateTime=0x88dd334a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2470)) returned 1 [0075.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0075.181] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\o3_fq.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\O3_fQ.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\o3_fq.gif.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif", lpFilePart=0x0) returned 0x39 [0075.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0075.181] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\znpz5a8.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.181] GetFileType (hFile=0x2d0) returned 0x1 [0075.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0075.181] GetFileType (hFile=0x2d0) returned 0x1 [0075.181] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x5850 [0075.181] ReadFile (in: hFile=0x2d0, lpBuffer=0x28823bc, nNumberOfBytesToRead=0x5850, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x28823bc*, lpNumberOfBytesRead=0x8fe718*=0x5850, lpOverlapped=0x0) returned 1 [0075.182] CloseHandle (hObject=0x2d0) returned 1 [0075.245] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif", lpFilePart=0x0) returned 0x39 [0075.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0075.245] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\znpz5a8.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.246] GetFileType (hFile=0x2d0) returned 0x1 [0075.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0075.246] GetFileType (hFile=0x2d0) returned 0x1 [0075.246] WriteFile (in: hFile=0x2d0, lpBuffer=0x28eab9c*, nNumberOfBytesToWrite=0x5860, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x28eab9c*, lpNumberOfBytesWritten=0x8fe708*=0x5860, lpOverlapped=0x0) returned 1 [0075.247] CloseHandle (hObject=0x2d0) returned 1 [0075.248] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif", lpFilePart=0x0) returned 0x39 [0075.248] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x64 [0075.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0075.248] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\znpz5a8.gif"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda59eb0, ftCreationTime.dwHighDateTime=0x1d62605, ftLastAccessTime.dwLowDateTime=0x982002d0, ftLastAccessTime.dwHighDateTime=0x1d6302b, ftLastWriteTime.dwLowDateTime=0x88e6bc5d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5860)) returned 1 [0075.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0075.249] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\znpz5a8.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\ZNpZ5A8.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\znpz5a8.gif.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.249] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp", lpFilePart=0x0) returned 0x3e [0075.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0075.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\_-aql0eac_rt.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.249] GetFileType (hFile=0x2d0) returned 0x1 [0075.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0075.249] GetFileType (hFile=0x2d0) returned 0x1 [0075.249] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x12ba0 [0075.250] ReadFile (in: hFile=0x2d0, lpBuffer=0x28f08a8, nNumberOfBytesToRead=0x12ba0, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x28f08a8*, lpNumberOfBytesRead=0x8fe718*=0x12ba0, lpOverlapped=0x0) returned 1 [0075.250] CloseHandle (hObject=0x2d0) returned 1 [0075.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp", lpFilePart=0x0) returned 0x3e [0075.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0075.346] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\_-aql0eac_rt.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.347] GetFileType (hFile=0x2d0) returned 0x1 [0075.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0075.347] GetFileType (hFile=0x2d0) returned 0x1 [0075.348] WriteFile (in: hFile=0x2d0, lpBuffer=0x2788974*, nNumberOfBytesToWrite=0x12bb0, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x2788974*, lpNumberOfBytesWritten=0x8fe708*=0x12bb0, lpOverlapped=0x0) returned 1 [0075.349] CloseHandle (hObject=0x2d0) returned 1 [0075.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp", lpFilePart=0x0) returned 0x3e [0075.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x69 [0075.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0075.351] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\_-aql0eac_rt.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc71c390, ftCreationTime.dwHighDateTime=0x1d63131, ftLastAccessTime.dwLowDateTime=0x94fa60b0, ftLastAccessTime.dwHighDateTime=0x1d622b5, ftLastWriteTime.dwLowDateTime=0x88f76d09, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12bb0)) returned 1 [0075.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0075.351] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\_-aql0eac_rt.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\_-aql0Eac_rt.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\-6jz6\\6b1_xtualt1lle\\_-aql0eac_rt.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0075.352] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe", lpFilePart=0x0) returned 0x2d [0075.352] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\-6Jz6\\6b1_xTualT1LLe\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a9b320, ftCreationTime.dwHighDateTime=0x1d627ec, ftLastAccessTime.dwLowDateTime=0x88f76d09, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x88f76d09, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f08 [0075.352] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a9b320, ftCreationTime.dwHighDateTime=0x1d627ec, ftLastAccessTime.dwLowDateTime=0x88f76d09, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x88f76d09, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.352] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e79b650, ftCreationTime.dwHighDateTime=0x1d624db, ftLastAccessTime.dwLowDateTime=0x56800500, ftLastAccessTime.dwHighDateTime=0x1d62dfb, ftLastWriteTime.dwLowDateTime=0x88c2fa68, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C9sDHBA.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="2C9SDH~1.MAD")) returned 1 [0075.352] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd030f30, ftCreationTime.dwHighDateTime=0x1d62a48, ftLastAccessTime.dwLowDateTime=0x723c4f00, ftLastAccessTime.dwHighDateTime=0x1d628f2, ftLastWriteTime.dwLowDateTime=0x88c55c17, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1930, dwReserved0=0x0, dwReserved1=0x0, cFileName="5mE9JZjto.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="5ME9JZ~1.MAD")) returned 1 [0075.352] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd82e99d0, ftCreationTime.dwHighDateTime=0x1d62537, ftLastAccessTime.dwLowDateTime=0x3ad38a70, ftLastAccessTime.dwHighDateTime=0x1d62d1a, ftLastWriteTime.dwLowDateTime=0x88dad08d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x18860, dwReserved0=0x0, dwReserved1=0x0, cFileName="6tg-fHA2Ocuy.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="6TG-FH~1.MAD")) returned 1 [0075.352] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf902b0, ftCreationTime.dwHighDateTime=0x1d62795, ftLastAccessTime.dwLowDateTime=0xcacc9670, ftLastAccessTime.dwHighDateTime=0x1d631b7, ftLastWriteTime.dwLowDateTime=0x88dd334a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2470, dwReserved0=0x0, dwReserved1=0x0, cFileName="O3_fQ.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="O3_FQG~1.MAD")) returned 1 [0075.352] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda59eb0, ftCreationTime.dwHighDateTime=0x1d62605, ftLastAccessTime.dwLowDateTime=0x982002d0, ftLastAccessTime.dwHighDateTime=0x1d6302b, ftLastWriteTime.dwLowDateTime=0x88e6bc5d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5860, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNpZ5A8.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ZNPZ5A~1.MAD")) returned 1 [0075.353] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc71c390, ftCreationTime.dwHighDateTime=0x1d63131, ftLastAccessTime.dwLowDateTime=0x94fa60b0, ftLastAccessTime.dwHighDateTime=0x1d622b5, ftLastWriteTime.dwLowDateTime=0x88f76d09, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_-aql0Eac_rt.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="_-AQL0~1.MAD")) returned 1 [0075.353] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc71c390, ftCreationTime.dwHighDateTime=0x1d63131, ftLastAccessTime.dwLowDateTime=0x94fa60b0, ftLastAccessTime.dwHighDateTime=0x1d622b5, ftLastWriteTime.dwLowDateTime=0x88f76d09, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_-aql0Eac_rt.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="_-AQL0~1.MAD")) returned 0 [0075.353] FindClose (in: hFindFile=0xac0f08 | out: hFindFile=0xac0f08) returned 1 [0075.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0075.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0075.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0075.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0075.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0075.353] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1248 [0075.355] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.355] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.355] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.356] FindClose (in: hFindFile=0xac1248 | out: hFindFile=0xac1248) returned 1 [0075.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0075.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0075.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0075.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0075.356] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f88 [0075.356] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.356] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.356] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0075.357] FindClose (in: hFindFile=0xac0f88 | out: hFindFile=0xac0f88) returned 1 [0075.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0075.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0075.357] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od", lpFilePart=0x0) returned 0x22 [0075.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0075.357] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od", lpFilePart=0x0) returned 0x22 [0075.357] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x479bc430, ftCreationTime.dwHighDateTime=0x1d631c4, ftLastAccessTime.dwLowDateTime=0x52aeef40, ftLastAccessTime.dwHighDateTime=0x1d6295a, ftLastWriteTime.dwLowDateTime=0x52aeef40, ftLastWriteTime.dwHighDateTime=0x1d6295a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e88 [0075.357] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x479bc430, ftCreationTime.dwHighDateTime=0x1d631c4, ftLastAccessTime.dwLowDateTime=0x52aeef40, ftLastAccessTime.dwHighDateTime=0x1d6295a, ftLastWriteTime.dwLowDateTime=0x52aeef40, ftLastWriteTime.dwHighDateTime=0x1d6295a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.357] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65b0ec60, ftCreationTime.dwHighDateTime=0x1d62757, ftLastAccessTime.dwLowDateTime=0xe217a710, ftLastAccessTime.dwHighDateTime=0x1d624c0, ftLastWriteTime.dwLowDateTime=0xe217a710, ftLastWriteTime.dwHighDateTime=0x1d624c0, nFileSizeHigh=0x0, nFileSizeLow=0x1042c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ycCNUo2.png", cAlternateFileName="")) returned 1 [0075.357] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece01350, ftCreationTime.dwHighDateTime=0x1d62f77, ftLastAccessTime.dwLowDateTime=0x8da92cb0, ftLastAccessTime.dwHighDateTime=0x1d6275b, ftLastWriteTime.dwLowDateTime=0x8da92cb0, ftLastWriteTime.dwHighDateTime=0x1d6275b, nFileSizeHigh=0x0, nFileSizeLow=0x11e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="zqlhS2CBIt.jpg", cAlternateFileName="ZQLHS2~1.JPG")) returned 1 [0075.357] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.358] FindClose (in: hFindFile=0xac0e88 | out: hFindFile=0xac0e88) returned 1 [0075.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0075.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0075.358] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png", lpFilePart=0x0) returned 0x2e [0075.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0075.358] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dddzht od\\yccnuo2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.358] GetFileType (hFile=0x2d0) returned 0x1 [0075.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0075.358] GetFileType (hFile=0x2d0) returned 0x1 [0075.358] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x1042c [0075.358] ReadFile (in: hFile=0x2d0, lpBuffer=0x279e874, nNumberOfBytesToRead=0x1042c, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x279e874*, lpNumberOfBytesRead=0x8fe75c*=0x1042c, lpOverlapped=0x0) returned 1 [0075.358] CloseHandle (hObject=0x2d0) returned 1 [0075.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png", lpFilePart=0x0) returned 0x2e [0075.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0075.423] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dddzht od\\yccnuo2.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.424] GetFileType (hFile=0x2d0) returned 0x1 [0075.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0075.424] GetFileType (hFile=0x2d0) returned 0x1 [0075.424] WriteFile (in: hFile=0x2d0, lpBuffer=0x281c474*, nNumberOfBytesToWrite=0x10430, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x281c474*, lpNumberOfBytesWritten=0x8fe74c*=0x10430, lpOverlapped=0x0) returned 1 [0075.425] CloseHandle (hObject=0x2d0) returned 1 [0075.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png", lpFilePart=0x0) returned 0x2e [0075.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x59 [0075.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0075.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dddzht od\\yccnuo2.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65b0ec60, ftCreationTime.dwHighDateTime=0x1d62757, ftLastAccessTime.dwLowDateTime=0xe217a710, ftLastAccessTime.dwHighDateTime=0x1d624c0, ftLastWriteTime.dwLowDateTime=0x89035942, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10430)) returned 1 [0075.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0075.427] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dddzht od\\yccnuo2.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\ycCNUo2.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\dddzht od\\yccnuo2.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.430] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg", lpFilePart=0x0) returned 0x31 [0075.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0075.430] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dddzht od\\zqlhs2cbit.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.431] GetFileType (hFile=0x2d0) returned 0x1 [0075.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0075.431] GetFileType (hFile=0x2d0) returned 0x1 [0075.431] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x11e14 [0075.431] ReadFile (in: hFile=0x2d0, lpBuffer=0x282ccd8, nNumberOfBytesToRead=0x11e14, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x282ccd8*, lpNumberOfBytesRead=0x8fe75c*=0x11e14, lpOverlapped=0x0) returned 1 [0075.431] CloseHandle (hObject=0x2d0) returned 1 [0075.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg", lpFilePart=0x0) returned 0x31 [0075.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0075.450] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dddzht od\\zqlhs2cbit.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.451] GetFileType (hFile=0x2d0) returned 0x1 [0075.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0075.451] GetFileType (hFile=0x2d0) returned 0x1 [0075.451] WriteFile (in: hFile=0x2d0, lpBuffer=0x28af54c*, nNumberOfBytesToWrite=0x11e20, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28af54c*, lpNumberOfBytesWritten=0x8fe74c*=0x11e20, lpOverlapped=0x0) returned 1 [0075.452] CloseHandle (hObject=0x2d0) returned 1 [0075.454] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg", lpFilePart=0x0) returned 0x31 [0075.454] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5c [0075.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0075.454] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dddzht od\\zqlhs2cbit.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece01350, ftCreationTime.dwHighDateTime=0x1d62f77, ftLastAccessTime.dwLowDateTime=0x8da92cb0, ftLastAccessTime.dwHighDateTime=0x1d6275b, ftLastWriteTime.dwLowDateTime=0x8905b9fc, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11e20)) returned 1 [0075.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0075.454] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dddzht od\\zqlhs2cbit.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\zqlhS2CBIt.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\dddzht od\\zqlhs2cbit.jpg.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0075.503] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od", lpFilePart=0x0) returned 0x22 [0075.503] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\DdDZHt od\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x479bc430, ftCreationTime.dwHighDateTime=0x1d631c4, ftLastAccessTime.dwLowDateTime=0x8905b9fc, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8905b9fc, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1008 [0075.503] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x479bc430, ftCreationTime.dwHighDateTime=0x1d631c4, ftLastAccessTime.dwLowDateTime=0x8905b9fc, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8905b9fc, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.503] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65b0ec60, ftCreationTime.dwHighDateTime=0x1d62757, ftLastAccessTime.dwLowDateTime=0xe217a710, ftLastAccessTime.dwHighDateTime=0x1d624c0, ftLastWriteTime.dwLowDateTime=0x89035942, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10430, dwReserved0=0x0, dwReserved1=0x0, cFileName="ycCNUo2.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="YCCNUO~1.MAD")) returned 1 [0075.504] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece01350, ftCreationTime.dwHighDateTime=0x1d62f77, ftLastAccessTime.dwLowDateTime=0x8da92cb0, ftLastAccessTime.dwHighDateTime=0x1d6275b, ftLastWriteTime.dwLowDateTime=0x8905b9fc, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11e20, dwReserved0=0x0, dwReserved1=0x0, cFileName="zqlhS2CBIt.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ZQLHS2~1.MAD")) returned 1 [0075.504] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece01350, ftCreationTime.dwHighDateTime=0x1d62f77, ftLastAccessTime.dwLowDateTime=0x8da92cb0, ftLastAccessTime.dwHighDateTime=0x1d6275b, ftLastWriteTime.dwLowDateTime=0x8905b9fc, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11e20, dwReserved0=0x0, dwReserved1=0x0, cFileName="zqlhS2CBIt.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ZQLHS2~1.MAD")) returned 0 [0075.504] FindClose (in: hFindFile=0xac1008 | out: hFindFile=0xac1008) returned 1 [0075.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0075.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0075.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb", lpFilePart=0x0) returned 0x2d [0075.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0075.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb", lpFilePart=0x0) returned 0x2d [0075.504] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf88a6300, ftCreationTime.dwHighDateTime=0x1d63089, ftLastAccessTime.dwLowDateTime=0x9aaf99d0, ftLastAccessTime.dwHighDateTime=0x1d62e27, ftLastWriteTime.dwLowDateTime=0x9aaf99d0, ftLastWriteTime.dwHighDateTime=0x1d62e27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f88 [0075.504] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf88a6300, ftCreationTime.dwHighDateTime=0x1d63089, ftLastAccessTime.dwLowDateTime=0x9aaf99d0, ftLastAccessTime.dwHighDateTime=0x1d62e27, ftLastWriteTime.dwLowDateTime=0x9aaf99d0, ftLastWriteTime.dwHighDateTime=0x1d62e27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.504] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb158e0, ftCreationTime.dwHighDateTime=0x1d629a4, ftLastAccessTime.dwLowDateTime=0x6c39bcd0, ftLastAccessTime.dwHighDateTime=0x1d6293f, ftLastWriteTime.dwLowDateTime=0x6c39bcd0, ftLastWriteTime.dwHighDateTime=0x1d6293f, nFileSizeHigh=0x0, nFileSizeLow=0xeba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="9cz-ce4jL w3AVGJ3N.jpg", cAlternateFileName="9CZ-CE~1.JPG")) returned 1 [0075.504] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff493770, ftCreationTime.dwHighDateTime=0x1d62553, ftLastAccessTime.dwLowDateTime=0x5807c860, ftLastAccessTime.dwHighDateTime=0x1d62b88, ftLastWriteTime.dwLowDateTime=0x5807c860, ftLastWriteTime.dwHighDateTime=0x1d62b88, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CH_w8MUMw-S", cAlternateFileName="CH_W8M~1")) returned 1 [0075.505] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x213e5a50, ftCreationTime.dwHighDateTime=0x1d62c3d, ftLastAccessTime.dwLowDateTime=0x240310f0, ftLastAccessTime.dwHighDateTime=0x1d62b7f, ftLastWriteTime.dwLowDateTime=0x240310f0, ftLastWriteTime.dwHighDateTime=0x1d62b7f, nFileSizeHigh=0x0, nFileSizeLow=0x11406, dwReserved0=0x0, dwReserved1=0x0, cFileName="h2q_tsI.png", cAlternateFileName="")) returned 1 [0075.505] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ef3b20, ftCreationTime.dwHighDateTime=0x1d632cc, ftLastAccessTime.dwLowDateTime=0x37c7a990, ftLastAccessTime.dwHighDateTime=0x1d63005, ftLastWriteTime.dwLowDateTime=0x37c7a990, ftLastWriteTime.dwHighDateTime=0x1d63005, nFileSizeHigh=0x0, nFileSizeLow=0xff94, dwReserved0=0x0, dwReserved1=0x0, cFileName="NV8_xU1yck.jpg", cAlternateFileName="NV8_XU~1.JPG")) returned 1 [0075.505] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabfdac00, ftCreationTime.dwHighDateTime=0x1d62dfe, ftLastAccessTime.dwLowDateTime=0x6cce7a10, ftLastAccessTime.dwHighDateTime=0x1d62d21, ftLastWriteTime.dwLowDateTime=0x6cce7a10, ftLastWriteTime.dwHighDateTime=0x1d62d21, nFileSizeHigh=0x0, nFileSizeLow=0xbe33, dwReserved0=0x0, dwReserved1=0x0, cFileName="O87WOwr1XR1jJ6eUBl.png", cAlternateFileName="O87WOW~1.PNG")) returned 1 [0075.505] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bf5530, ftCreationTime.dwHighDateTime=0x1d628dd, ftLastAccessTime.dwLowDateTime=0x3122f3e0, ftLastAccessTime.dwHighDateTime=0x1d626a2, ftLastWriteTime.dwLowDateTime=0x3122f3e0, ftLastWriteTime.dwHighDateTime=0x1d626a2, nFileSizeHigh=0x0, nFileSizeLow=0x8f8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="QNCXZxfDdJwIYV-.bmp", cAlternateFileName="QNCXZX~1.BMP")) returned 1 [0075.505] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34451f50, ftCreationTime.dwHighDateTime=0x1d627fe, ftLastAccessTime.dwLowDateTime=0xc17d6be0, ftLastAccessTime.dwHighDateTime=0x1d632b5, ftLastWriteTime.dwLowDateTime=0xc17d6be0, ftLastWriteTime.dwHighDateTime=0x1d632b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVQC5", cAlternateFileName="")) returned 1 [0075.505] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34451f50, ftCreationTime.dwHighDateTime=0x1d627fe, ftLastAccessTime.dwLowDateTime=0xc17d6be0, ftLastAccessTime.dwHighDateTime=0x1d632b5, ftLastWriteTime.dwLowDateTime=0xc17d6be0, ftLastWriteTime.dwHighDateTime=0x1d632b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVQC5", cAlternateFileName="")) returned 0 [0075.505] FindClose (in: hFindFile=0xac0f88 | out: hFindFile=0xac0f88) returned 1 [0075.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0075.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0075.505] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg", lpFilePart=0x0) returned 0x44 [0075.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0075.505] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\9cz-ce4jl w3avgj3n.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.505] GetFileType (hFile=0x2d0) returned 0x1 [0075.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0075.505] GetFileType (hFile=0x2d0) returned 0x1 [0075.505] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xeba7 [0075.505] ReadFile (in: hFile=0x2d0, lpBuffer=0x28c37a8, nNumberOfBytesToRead=0xeba7, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28c37a8*, lpNumberOfBytesRead=0x8fe75c*=0xeba7, lpOverlapped=0x0) returned 1 [0075.506] CloseHandle (hObject=0x2d0) returned 1 [0075.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg", lpFilePart=0x0) returned 0x44 [0075.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0075.525] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\9cz-ce4jl w3avgj3n.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.526] GetFileType (hFile=0x2d0) returned 0x1 [0075.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0075.526] GetFileType (hFile=0x2d0) returned 0x1 [0075.526] WriteFile (in: hFile=0x2d0, lpBuffer=0x27468a0*, nNumberOfBytesToWrite=0xebb0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27468a0*, lpNumberOfBytesWritten=0x8fe74c*=0xebb0, lpOverlapped=0x0) returned 1 [0075.527] CloseHandle (hObject=0x2d0) returned 1 [0075.529] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg", lpFilePart=0x0) returned 0x44 [0075.529] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6f [0075.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0075.529] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\9cz-ce4jl w3avgj3n.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb158e0, ftCreationTime.dwHighDateTime=0x1d629a4, ftLastAccessTime.dwLowDateTime=0x6c39bcd0, ftLastAccessTime.dwHighDateTime=0x1d6293f, ftLastWriteTime.dwLowDateTime=0x8911a792, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xebb0)) returned 1 [0075.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0075.529] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\9cz-ce4jl w3avgj3n.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\9cz-ce4jL w3AVGJ3N.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\9cz-ce4jl w3avgj3n.jpg.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.530] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png", lpFilePart=0x0) returned 0x39 [0075.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0075.530] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\h2q_tsi.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.530] GetFileType (hFile=0x2d0) returned 0x1 [0075.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0075.530] GetFileType (hFile=0x2d0) returned 0x1 [0075.530] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x11406 [0075.530] ReadFile (in: hFile=0x2d0, lpBuffer=0x2755954, nNumberOfBytesToRead=0x11406, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2755954*, lpNumberOfBytesRead=0x8fe75c*=0x11406, lpOverlapped=0x0) returned 1 [0075.530] CloseHandle (hObject=0x2d0) returned 1 [0075.617] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png", lpFilePart=0x0) returned 0x39 [0075.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0075.617] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\h2q_tsi.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.618] GetFileType (hFile=0x2d0) returned 0x1 [0075.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0075.618] GetFileType (hFile=0x2d0) returned 0x1 [0075.618] WriteFile (in: hFile=0x2d0, lpBuffer=0x27d64f8*, nNumberOfBytesToWrite=0x11410, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27d64f8*, lpNumberOfBytesWritten=0x8fe74c*=0x11410, lpOverlapped=0x0) returned 1 [0075.620] CloseHandle (hObject=0x2d0) returned 1 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png", lpFilePart=0x0) returned 0x39 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x64 [0075.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0075.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\h2q_tsi.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x213e5a50, ftCreationTime.dwHighDateTime=0x1d62c3d, ftLastAccessTime.dwLowDateTime=0x240310f0, ftLastAccessTime.dwHighDateTime=0x1d62b7f, ftLastWriteTime.dwLowDateTime=0x891ff54d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11410)) returned 1 [0075.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0075.622] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\h2q_tsi.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\h2q_tsI.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\h2q_tsi.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.623] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg", lpFilePart=0x0) returned 0x3c [0075.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0075.623] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\nv8_xu1yck.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.623] GetFileType (hFile=0x2d0) returned 0x1 [0075.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0075.623] GetFileType (hFile=0x2d0) returned 0x1 [0075.623] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xff94 [0075.623] ReadFile (in: hFile=0x2d0, lpBuffer=0x27e7dac, nNumberOfBytesToRead=0xff94, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x27e7dac*, lpNumberOfBytesRead=0x8fe75c*=0xff94, lpOverlapped=0x0) returned 1 [0075.623] CloseHandle (hObject=0x2d0) returned 1 [0075.692] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg", lpFilePart=0x0) returned 0x3c [0075.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0075.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\nv8_xu1yck.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.693] GetFileType (hFile=0x2d0) returned 0x1 [0075.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0075.693] GetFileType (hFile=0x2d0) returned 0x1 [0075.693] WriteFile (in: hFile=0x2d0, lpBuffer=0x2864aa0*, nNumberOfBytesToWrite=0xffa0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2864aa0*, lpNumberOfBytesWritten=0x8fe74c*=0xffa0, lpOverlapped=0x0) returned 1 [0075.694] CloseHandle (hObject=0x2d0) returned 1 [0075.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg", lpFilePart=0x0) returned 0x3c [0075.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x67 [0075.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0075.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\nv8_xu1yck.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ef3b20, ftCreationTime.dwHighDateTime=0x1d632cc, ftLastAccessTime.dwLowDateTime=0x37c7a990, ftLastAccessTime.dwHighDateTime=0x1d63005, ftLastWriteTime.dwLowDateTime=0x892be0bf, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xffa0)) returned 1 [0075.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0075.697] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\nv8_xu1yck.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\NV8_xU1yck.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\nv8_xu1yck.jpg.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.697] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png", lpFilePart=0x0) returned 0x44 [0075.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0075.697] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\o87wowr1xr1jj6eubl.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.697] GetFileType (hFile=0x2d0) returned 0x1 [0075.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0075.697] GetFileType (hFile=0x2d0) returned 0x1 [0075.697] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xbe33 [0075.698] ReadFile (in: hFile=0x2d0, lpBuffer=0x2874f24, nNumberOfBytesToRead=0xbe33, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2874f24*, lpNumberOfBytesRead=0x8fe75c*=0xbe33, lpOverlapped=0x0) returned 1 [0075.698] CloseHandle (hObject=0x2d0) returned 1 [0075.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png", lpFilePart=0x0) returned 0x44 [0075.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0075.715] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\o87wowr1xr1jj6eubl.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.716] GetFileType (hFile=0x2d0) returned 0x1 [0075.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0075.716] GetFileType (hFile=0x2d0) returned 0x1 [0075.716] WriteFile (in: hFile=0x2d0, lpBuffer=0x28e57fc*, nNumberOfBytesToWrite=0xbe40, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28e57fc*, lpNumberOfBytesWritten=0x8fe74c*=0xbe40, lpOverlapped=0x0) returned 1 [0075.717] CloseHandle (hObject=0x2d0) returned 1 [0075.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png", lpFilePart=0x0) returned 0x44 [0075.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6f [0075.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0075.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\o87wowr1xr1jj6eubl.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabfdac00, ftCreationTime.dwHighDateTime=0x1d62dfe, ftLastAccessTime.dwLowDateTime=0x6cce7a10, ftLastAccessTime.dwHighDateTime=0x1d62d21, ftLastWriteTime.dwLowDateTime=0x892e4348, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xbe40)) returned 1 [0075.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0075.719] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\o87wowr1xr1jj6eubl.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\O87WOwr1XR1jJ6eUBl.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\o87wowr1xr1jj6eubl.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.720] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp", lpFilePart=0x0) returned 0x41 [0075.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0075.720] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\qncxzxfddjwiyv-.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.720] GetFileType (hFile=0x2d0) returned 0x1 [0075.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0075.720] GetFileType (hFile=0x2d0) returned 0x1 [0075.720] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x8f8a [0075.720] ReadFile (in: hFile=0x2d0, lpBuffer=0x28f1b60, nNumberOfBytesToRead=0x8f8a, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28f1b60*, lpNumberOfBytesRead=0x8fe75c*=0x8f8a, lpOverlapped=0x0) returned 1 [0075.720] CloseHandle (hObject=0x2d0) returned 1 [0075.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp", lpFilePart=0x0) returned 0x41 [0075.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0075.813] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\qncxzxfddjwiyv-.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.814] GetFileType (hFile=0x2d0) returned 0x1 [0075.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0075.814] GetFileType (hFile=0x2d0) returned 0x1 [0075.814] WriteFile (in: hFile=0x2d0, lpBuffer=0x274e658*, nNumberOfBytesToWrite=0x8f90, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x274e658*, lpNumberOfBytesWritten=0x8fe74c*=0x8f90, lpOverlapped=0x0) returned 1 [0075.815] CloseHandle (hObject=0x2d0) returned 1 [0075.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp", lpFilePart=0x0) returned 0x41 [0075.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6c [0075.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0075.817] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\qncxzxfddjwiyv-.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bf5530, ftCreationTime.dwHighDateTime=0x1d628dd, ftLastAccessTime.dwLowDateTime=0x3122f3e0, ftLastAccessTime.dwHighDateTime=0x1d626a2, ftLastWriteTime.dwLowDateTime=0x893ef36c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8f90)) returned 1 [0075.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0075.817] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\qncxzxfddjwiyv-.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\QNCXZxfDdJwIYV-.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\qncxzxfddjwiyv-.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0075.818] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb", lpFilePart=0x0) returned 0x2d [0075.818] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf88a6300, ftCreationTime.dwHighDateTime=0x1d63089, ftLastAccessTime.dwLowDateTime=0x893ef36c, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x893ef36c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0075.818] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf88a6300, ftCreationTime.dwHighDateTime=0x1d63089, ftLastAccessTime.dwLowDateTime=0x893ef36c, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x893ef36c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.818] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb158e0, ftCreationTime.dwHighDateTime=0x1d629a4, ftLastAccessTime.dwLowDateTime=0x6c39bcd0, ftLastAccessTime.dwHighDateTime=0x1d6293f, ftLastWriteTime.dwLowDateTime=0x8911a792, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xebb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9cz-ce4jL w3AVGJ3N.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="9CZ-CE~1.MAD")) returned 1 [0075.818] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff493770, ftCreationTime.dwHighDateTime=0x1d62553, ftLastAccessTime.dwLowDateTime=0x5807c860, ftLastAccessTime.dwHighDateTime=0x1d62b88, ftLastWriteTime.dwLowDateTime=0x5807c860, ftLastWriteTime.dwHighDateTime=0x1d62b88, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CH_w8MUMw-S", cAlternateFileName="CH_W8M~1")) returned 1 [0075.818] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x213e5a50, ftCreationTime.dwHighDateTime=0x1d62c3d, ftLastAccessTime.dwLowDateTime=0x240310f0, ftLastAccessTime.dwHighDateTime=0x1d62b7f, ftLastWriteTime.dwLowDateTime=0x891ff54d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11410, dwReserved0=0x0, dwReserved1=0x0, cFileName="h2q_tsI.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="H2Q_TS~1.MAD")) returned 1 [0075.818] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ef3b20, ftCreationTime.dwHighDateTime=0x1d632cc, ftLastAccessTime.dwLowDateTime=0x37c7a990, ftLastAccessTime.dwHighDateTime=0x1d63005, ftLastWriteTime.dwLowDateTime=0x892be0bf, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xffa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NV8_xU1yck.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="NV8_XU~1.MAD")) returned 1 [0075.819] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabfdac00, ftCreationTime.dwHighDateTime=0x1d62dfe, ftLastAccessTime.dwLowDateTime=0x6cce7a10, ftLastAccessTime.dwHighDateTime=0x1d62d21, ftLastWriteTime.dwLowDateTime=0x892e4348, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xbe40, dwReserved0=0x0, dwReserved1=0x0, cFileName="O87WOwr1XR1jJ6eUBl.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="O87WOW~1.MAD")) returned 1 [0075.819] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bf5530, ftCreationTime.dwHighDateTime=0x1d628dd, ftLastAccessTime.dwLowDateTime=0x3122f3e0, ftLastAccessTime.dwHighDateTime=0x1d626a2, ftLastWriteTime.dwLowDateTime=0x893ef36c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="QNCXZxfDdJwIYV-.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="QNCXZX~1.MAD")) returned 1 [0075.819] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34451f50, ftCreationTime.dwHighDateTime=0x1d627fe, ftLastAccessTime.dwLowDateTime=0xc17d6be0, ftLastAccessTime.dwHighDateTime=0x1d632b5, ftLastWriteTime.dwLowDateTime=0xc17d6be0, ftLastWriteTime.dwHighDateTime=0x1d632b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVQC5", cAlternateFileName="")) returned 1 [0075.819] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.819] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0075.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0075.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0075.819] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S", nBufferLength=0x105, lpBuffer=0x8fe250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S", lpFilePart=0x0) returned 0x39 [0075.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0075.819] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S", lpFilePart=0x0) returned 0x39 [0075.819] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff493770, ftCreationTime.dwHighDateTime=0x1d62553, ftLastAccessTime.dwLowDateTime=0x5807c860, ftLastAccessTime.dwHighDateTime=0x1d62b88, ftLastWriteTime.dwLowDateTime=0x5807c860, ftLastWriteTime.dwHighDateTime=0x1d62b88, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1288 [0075.819] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff493770, ftCreationTime.dwHighDateTime=0x1d62553, ftLastAccessTime.dwLowDateTime=0x5807c860, ftLastAccessTime.dwHighDateTime=0x1d62b88, ftLastWriteTime.dwLowDateTime=0x5807c860, ftLastWriteTime.dwHighDateTime=0x1d62b88, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.820] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52af93d0, ftCreationTime.dwHighDateTime=0x1d6252e, ftLastAccessTime.dwLowDateTime=0xaa84c3b0, ftLastAccessTime.dwHighDateTime=0x1d62884, ftLastWriteTime.dwLowDateTime=0xaa84c3b0, ftLastWriteTime.dwHighDateTime=0x1d62884, nFileSizeHigh=0x0, nFileSizeLow=0x174a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Em3NUssxgsjjbAZfYU.gif", cAlternateFileName="EM3NUS~1.GIF")) returned 1 [0075.820] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x961ae680, ftCreationTime.dwHighDateTime=0x1d62513, ftLastAccessTime.dwLowDateTime=0xe7859630, ftLastAccessTime.dwHighDateTime=0x1d63320, ftLastWriteTime.dwLowDateTime=0xe7859630, ftLastWriteTime.dwHighDateTime=0x1d63320, nFileSizeHigh=0x0, nFileSizeLow=0xd40f, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaRORd7.gif", cAlternateFileName="")) returned 1 [0075.820] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0dc7290, ftCreationTime.dwHighDateTime=0x1d62b02, ftLastAccessTime.dwLowDateTime=0x2b6daf80, ftLastAccessTime.dwHighDateTime=0x1d62d5f, ftLastWriteTime.dwLowDateTime=0x2b6daf80, ftLastWriteTime.dwHighDateTime=0x1d62d5f, nFileSizeHigh=0x0, nFileSizeLow=0xfa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="nKfdv.bmp", cAlternateFileName="")) returned 1 [0075.820] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2670ddb0, ftCreationTime.dwHighDateTime=0x1d62ab0, ftLastAccessTime.dwLowDateTime=0x583343b0, ftLastAccessTime.dwHighDateTime=0x1d631b3, ftLastWriteTime.dwLowDateTime=0x583343b0, ftLastWriteTime.dwHighDateTime=0x1d631b3, nFileSizeHigh=0x0, nFileSizeLow=0xd02c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oa7U.bmp", cAlternateFileName="")) returned 1 [0075.820] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf3d2570, ftCreationTime.dwHighDateTime=0x1d62866, ftLastAccessTime.dwLowDateTime=0x7c723820, ftLastAccessTime.dwHighDateTime=0x1d6330d, ftLastWriteTime.dwLowDateTime=0x7c723820, ftLastWriteTime.dwHighDateTime=0x1d6330d, nFileSizeHigh=0x0, nFileSizeLow=0x533d, dwReserved0=0x0, dwReserved1=0x0, cFileName="uT9c.gif", cAlternateFileName="")) returned 1 [0075.820] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e1300, ftCreationTime.dwHighDateTime=0x1d624b1, ftLastAccessTime.dwLowDateTime=0x982eebb0, ftLastAccessTime.dwHighDateTime=0x1d63143, ftLastWriteTime.dwLowDateTime=0x982eebb0, ftLastWriteTime.dwHighDateTime=0x1d63143, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WG19FLh Wf", cAlternateFileName="WG19FL~1")) returned 1 [0075.820] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e1300, ftCreationTime.dwHighDateTime=0x1d624b1, ftLastAccessTime.dwLowDateTime=0x982eebb0, ftLastAccessTime.dwHighDateTime=0x1d63143, ftLastWriteTime.dwLowDateTime=0x982eebb0, ftLastWriteTime.dwHighDateTime=0x1d63143, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WG19FLh Wf", cAlternateFileName="WG19FL~1")) returned 0 [0075.820] FindClose (in: hFindFile=0xac1288 | out: hFindFile=0xac1288) returned 1 [0075.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0075.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0075.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif", lpFilePart=0x0) returned 0x50 [0075.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0075.821] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\em3nussxgsjjbazfyu.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.821] GetFileType (hFile=0x2d0) returned 0x1 [0075.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0075.821] GetFileType (hFile=0x2d0) returned 0x1 [0075.821] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x174a3 [0075.821] ReadFile (in: hFile=0x2d0, lpBuffer=0x38ebb40, nNumberOfBytesToRead=0x174a3, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x38ebb40*, lpNumberOfBytesRead=0x8fe718*=0x174a3, lpOverlapped=0x0) returned 1 [0075.822] CloseHandle (hObject=0x2d0) returned 1 [0075.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif", lpFilePart=0x0) returned 0x50 [0075.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0075.894] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\em3nussxgsjjbazfyu.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.896] GetFileType (hFile=0x2d0) returned 0x1 [0075.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0075.896] GetFileType (hFile=0x2d0) returned 0x1 [0075.896] WriteFile (in: hFile=0x2d0, lpBuffer=0x39602e0*, nNumberOfBytesToWrite=0x174b0, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x39602e0*, lpNumberOfBytesWritten=0x8fe708*=0x174b0, lpOverlapped=0x0) returned 1 [0075.897] CloseHandle (hObject=0x2d0) returned 1 [0075.899] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif", lpFilePart=0x0) returned 0x50 [0075.899] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x7b [0075.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0075.900] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\em3nussxgsjjbazfyu.gif"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52af93d0, ftCreationTime.dwHighDateTime=0x1d6252e, ftLastAccessTime.dwLowDateTime=0xaa84c3b0, ftLastAccessTime.dwHighDateTime=0x1d62884, ftLastWriteTime.dwLowDateTime=0x894adf72, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x174b0)) returned 1 [0075.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0075.900] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\em3nussxgsjjbazfyu.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\Em3NUssxgsjjbAZfYU.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\em3nussxgsjjbazfyu.gif.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif", lpFilePart=0x0) returned 0x45 [0075.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0075.900] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\jarord7.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.901] GetFileType (hFile=0x2d0) returned 0x1 [0075.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0075.901] GetFileType (hFile=0x2d0) returned 0x1 [0075.901] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0xd40f [0075.901] ReadFile (in: hFile=0x2d0, lpBuffer=0x27a7cc8, nNumberOfBytesToRead=0xd40f, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x27a7cc8*, lpNumberOfBytesRead=0x8fe718*=0xd40f, lpOverlapped=0x0) returned 1 [0075.901] CloseHandle (hObject=0x2d0) returned 1 [0075.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif", lpFilePart=0x0) returned 0x45 [0075.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0075.918] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\jarord7.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.919] GetFileType (hFile=0x2d0) returned 0x1 [0075.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0075.919] GetFileType (hFile=0x2d0) returned 0x1 [0075.919] WriteFile (in: hFile=0x2d0, lpBuffer=0x281c710*, nNumberOfBytesToWrite=0xd410, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x281c710*, lpNumberOfBytesWritten=0x8fe708*=0xd410, lpOverlapped=0x0) returned 1 [0075.921] CloseHandle (hObject=0x2d0) returned 1 [0075.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif", lpFilePart=0x0) returned 0x45 [0075.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x70 [0075.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0075.922] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\jarord7.gif"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x961ae680, ftCreationTime.dwHighDateTime=0x1d62513, ftLastAccessTime.dwLowDateTime=0xe7859630, ftLastAccessTime.dwHighDateTime=0x1d63320, ftLastWriteTime.dwLowDateTime=0x894d42bb, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd410)) returned 1 [0075.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0075.923] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\jarord7.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\jaRORd7.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\jarord7.gif.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.923] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp", lpFilePart=0x0) returned 0x43 [0075.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0075.974] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\nkfdv.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.974] GetFileType (hFile=0x2d0) returned 0x1 [0075.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0075.974] GetFileType (hFile=0x2d0) returned 0x1 [0075.974] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0xfa3a [0075.974] ReadFile (in: hFile=0x2d0, lpBuffer=0x282a024, nNumberOfBytesToRead=0xfa3a, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x282a024*, lpNumberOfBytesRead=0x8fe718*=0xfa3a, lpOverlapped=0x0) returned 1 [0075.974] CloseHandle (hObject=0x2d0) returned 1 [0075.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp", lpFilePart=0x0) returned 0x43 [0075.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0075.992] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\nkfdv.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.993] GetFileType (hFile=0x2d0) returned 0x1 [0075.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0075.993] GetFileType (hFile=0x2d0) returned 0x1 [0075.993] WriteFile (in: hFile=0x2d0, lpBuffer=0x28a5cfc*, nNumberOfBytesToWrite=0xfa40, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x28a5cfc*, lpNumberOfBytesWritten=0x8fe708*=0xfa40, lpOverlapped=0x0) returned 1 [0075.994] CloseHandle (hObject=0x2d0) returned 1 [0075.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp", lpFilePart=0x0) returned 0x43 [0075.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6e [0075.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0075.996] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\nkfdv.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0dc7290, ftCreationTime.dwHighDateTime=0x1d62b02, ftLastAccessTime.dwLowDateTime=0x2b6daf80, ftLastAccessTime.dwHighDateTime=0x1d62d5f, ftLastWriteTime.dwLowDateTime=0x89592dd0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfa40)) returned 1 [0075.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0075.996] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\nkfdv.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\nKfdv.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\nkfdv.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0075.997] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp", lpFilePart=0x0) returned 0x42 [0075.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0075.997] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\oa7u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0075.997] GetFileType (hFile=0x2d0) returned 0x1 [0075.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0075.997] GetFileType (hFile=0x2d0) returned 0x1 [0075.997] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0xd02c [0075.997] ReadFile (in: hFile=0x2d0, lpBuffer=0x28b5c2c, nNumberOfBytesToRead=0xd02c, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x28b5c2c*, lpNumberOfBytesRead=0x8fe718*=0xd02c, lpOverlapped=0x0) returned 1 [0075.998] CloseHandle (hObject=0x2d0) returned 1 [0076.068] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp", lpFilePart=0x0) returned 0x42 [0076.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0076.069] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\oa7u.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.070] GetFileType (hFile=0x2d0) returned 0x1 [0076.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0076.070] GetFileType (hFile=0x2d0) returned 0x1 [0076.070] WriteFile (in: hFile=0x2d0, lpBuffer=0x26ec844*, nNumberOfBytesToWrite=0xd030, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x26ec844*, lpNumberOfBytesWritten=0x8fe708*=0xd030, lpOverlapped=0x0) returned 1 [0076.071] CloseHandle (hObject=0x2d0) returned 1 [0076.073] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp", lpFilePart=0x0) returned 0x42 [0076.073] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6d [0076.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0076.073] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\oa7u.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2670ddb0, ftCreationTime.dwHighDateTime=0x1d62ab0, ftLastAccessTime.dwLowDateTime=0x583343b0, ftLastAccessTime.dwHighDateTime=0x1d631b3, ftLastWriteTime.dwLowDateTime=0x89651a60, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd030)) returned 1 [0076.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0076.073] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\oa7u.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\oa7U.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\oa7u.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.074] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif", lpFilePart=0x0) returned 0x42 [0076.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0076.074] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\ut9c.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.074] GetFileType (hFile=0x2d0) returned 0x1 [0076.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0076.074] GetFileType (hFile=0x2d0) returned 0x1 [0076.074] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x533d [0076.074] ReadFile (in: hFile=0x2d0, lpBuffer=0x26f9d5c, nNumberOfBytesToRead=0x533d, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x26f9d5c*, lpNumberOfBytesRead=0x8fe718*=0x533d, lpOverlapped=0x0) returned 1 [0076.074] CloseHandle (hObject=0x2d0) returned 1 [0076.172] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif", lpFilePart=0x0) returned 0x42 [0076.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0076.173] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\ut9c.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.297] GetFileType (hFile=0x2d0) returned 0x1 [0076.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0076.297] GetFileType (hFile=0x2d0) returned 0x1 [0076.297] WriteFile (in: hFile=0x2d0, lpBuffer=0x2760cfc*, nNumberOfBytesToWrite=0x5340, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x2760cfc*, lpNumberOfBytesWritten=0x8fe708*=0x5340, lpOverlapped=0x0) returned 1 [0076.298] CloseHandle (hObject=0x2d0) returned 1 [0076.299] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif", lpFilePart=0x0) returned 0x42 [0076.299] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6d [0076.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0076.299] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\ut9c.gif"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf3d2570, ftCreationTime.dwHighDateTime=0x1d62866, ftLastAccessTime.dwLowDateTime=0x7c723820, ftLastAccessTime.dwHighDateTime=0x1d6330d, ftLastWriteTime.dwLowDateTime=0x8988e872, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5340)) returned 1 [0076.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0076.300] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\ut9c.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\uT9c.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\ut9c.gif.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0076.300] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S", lpFilePart=0x0) returned 0x39 [0076.300] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff493770, ftCreationTime.dwHighDateTime=0x1d62553, ftLastAccessTime.dwLowDateTime=0x8988e872, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8988e872, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1508 [0076.301] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff493770, ftCreationTime.dwHighDateTime=0x1d62553, ftLastAccessTime.dwLowDateTime=0x8988e872, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8988e872, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52af93d0, ftCreationTime.dwHighDateTime=0x1d6252e, ftLastAccessTime.dwLowDateTime=0xaa84c3b0, ftLastAccessTime.dwHighDateTime=0x1d62884, ftLastWriteTime.dwLowDateTime=0x894adf72, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x174b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Em3NUssxgsjjbAZfYU.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EM3NUS~1.MAD")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x961ae680, ftCreationTime.dwHighDateTime=0x1d62513, ftLastAccessTime.dwLowDateTime=0xe7859630, ftLastAccessTime.dwHighDateTime=0x1d63320, ftLastWriteTime.dwLowDateTime=0x894d42bb, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd410, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaRORd7.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="JARORD~1.MAD")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0dc7290, ftCreationTime.dwHighDateTime=0x1d62b02, ftLastAccessTime.dwLowDateTime=0x2b6daf80, ftLastAccessTime.dwHighDateTime=0x1d62d5f, ftLastWriteTime.dwLowDateTime=0x89592dd0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="nKfdv.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="NKFDVB~1.MAD")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2670ddb0, ftCreationTime.dwHighDateTime=0x1d62ab0, ftLastAccessTime.dwLowDateTime=0x583343b0, ftLastAccessTime.dwHighDateTime=0x1d631b3, ftLastWriteTime.dwLowDateTime=0x89651a60, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd030, dwReserved0=0x0, dwReserved1=0x0, cFileName="oa7U.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="OA7UBM~1.MAD")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf3d2570, ftCreationTime.dwHighDateTime=0x1d62866, ftLastAccessTime.dwLowDateTime=0x7c723820, ftLastAccessTime.dwHighDateTime=0x1d6330d, ftLastWriteTime.dwLowDateTime=0x8988e872, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5340, dwReserved0=0x0, dwReserved1=0x0, cFileName="uT9c.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UT9CGI~1.MAD")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e1300, ftCreationTime.dwHighDateTime=0x1d624b1, ftLastAccessTime.dwLowDateTime=0x982eebb0, ftLastAccessTime.dwHighDateTime=0x1d63143, ftLastWriteTime.dwLowDateTime=0x982eebb0, ftLastWriteTime.dwHighDateTime=0x1d63143, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WG19FLh Wf", cAlternateFileName="WG19FL~1")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.301] FindClose (in: hFindFile=0xac1508 | out: hFindFile=0xac1508) returned 1 [0076.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0076.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0076.302] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf", nBufferLength=0x105, lpBuffer=0x8fe20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf", lpFilePart=0x0) returned 0x44 [0076.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0076.302] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf", nBufferLength=0x105, lpBuffer=0x8fe1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf", lpFilePart=0x0) returned 0x44 [0076.302] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\*", lpFindFileData=0x8fe44c | out: lpFindFileData=0x8fe44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e1300, ftCreationTime.dwHighDateTime=0x1d624b1, ftLastAccessTime.dwLowDateTime=0x982eebb0, ftLastAccessTime.dwHighDateTime=0x1d63143, ftLastWriteTime.dwLowDateTime=0x982eebb0, ftLastWriteTime.dwHighDateTime=0x1d63143, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0076.302] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e1300, ftCreationTime.dwHighDateTime=0x1d624b1, ftLastAccessTime.dwLowDateTime=0x982eebb0, ftLastAccessTime.dwHighDateTime=0x1d63143, ftLastWriteTime.dwLowDateTime=0x982eebb0, ftLastWriteTime.dwHighDateTime=0x1d63143, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.302] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0681a70, ftCreationTime.dwHighDateTime=0x1d6320f, ftLastAccessTime.dwLowDateTime=0xe10056a0, ftLastAccessTime.dwHighDateTime=0x1d623ef, ftLastWriteTime.dwLowDateTime=0xe10056a0, ftLastWriteTime.dwHighDateTime=0x1d623ef, nFileSizeHigh=0x0, nFileSizeLow=0x851a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bg0A1R.bmp", cAlternateFileName="")) returned 1 [0076.302] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4f396b0, ftCreationTime.dwHighDateTime=0x1d62e37, ftLastAccessTime.dwLowDateTime=0x836722d0, ftLastAccessTime.dwHighDateTime=0x1d62589, ftLastWriteTime.dwLowDateTime=0x836722d0, ftLastWriteTime.dwHighDateTime=0x1d62589, nFileSizeHigh=0x0, nFileSizeLow=0x4ee2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HE-WDoE.gif", cAlternateFileName="")) returned 1 [0076.302] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5df67be0, ftCreationTime.dwHighDateTime=0x1d628b3, ftLastAccessTime.dwLowDateTime=0xf1f60340, ftLastAccessTime.dwHighDateTime=0x1d62b53, ftLastWriteTime.dwLowDateTime=0xf1f60340, ftLastWriteTime.dwHighDateTime=0x1d62b53, nFileSizeHigh=0x0, nFileSizeLow=0xa86d, dwReserved0=0x0, dwReserved1=0x0, cFileName="pJK40crasERE.png", cAlternateFileName="PJK40C~1.PNG")) returned 1 [0076.302] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.302] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0076.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6e0) returned 1 [0076.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0076.302] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp", nBufferLength=0x105, lpBuffer=0x8fe0e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp", lpFilePart=0x0) returned 0x4f [0076.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe62c) returned 1 [0076.303] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\bg0a1r.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.303] GetFileType (hFile=0x2d0) returned 0x1 [0076.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe628) returned 1 [0076.303] GetFileType (hFile=0x2d0) returned 0x1 [0076.303] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe728 | out: lpFileSizeHigh=0x8fe728*=0x0) returned 0x851a [0076.303] ReadFile (in: hFile=0x2d0, lpBuffer=0x2768cec, nNumberOfBytesToRead=0x851a, lpNumberOfBytesRead=0x8fe6d4, lpOverlapped=0x0 | out: lpBuffer=0x2768cec*, lpNumberOfBytesRead=0x8fe6d4*=0x851a, lpOverlapped=0x0) returned 1 [0076.303] CloseHandle (hObject=0x2d0) returned 1 [0076.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp", nBufferLength=0x105, lpBuffer=0x8fe0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp", lpFilePart=0x0) returned 0x4f [0076.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe614) returned 1 [0076.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\bg0a1r.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.320] GetFileType (hFile=0x2d0) returned 0x1 [0076.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe610) returned 1 [0076.320] GetFileType (hFile=0x2d0) returned 0x1 [0076.320] WriteFile (in: hFile=0x2d0, lpBuffer=0x27df490*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x8fe6c4, lpOverlapped=0x0 | out: lpBuffer=0x27df490*, lpNumberOfBytesWritten=0x8fe6c4*=0x8520, lpOverlapped=0x0) returned 1 [0076.321] CloseHandle (hObject=0x2d0) returned 1 [0076.322] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp", lpFilePart=0x0) returned 0x4f [0076.322] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x7a [0076.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6ac) returned 1 [0076.322] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\bg0a1r.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe728 | out: lpFileInformation=0x8fe728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0681a70, ftCreationTime.dwHighDateTime=0x1d6320f, ftLastAccessTime.dwLowDateTime=0xe10056a0, ftLastAccessTime.dwHighDateTime=0x1d623ef, ftLastWriteTime.dwLowDateTime=0x898b3ec0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8520)) returned 1 [0076.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6a8) returned 1 [0076.322] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\bg0a1r.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\Bg0A1R.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\bg0a1r.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.324] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif", nBufferLength=0x105, lpBuffer=0x8fe0e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif", lpFilePart=0x0) returned 0x50 [0076.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe62c) returned 1 [0076.324] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\he-wdoe.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.324] GetFileType (hFile=0x2d0) returned 0x1 [0076.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe628) returned 1 [0076.324] GetFileType (hFile=0x2d0) returned 0x1 [0076.325] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe728 | out: lpFileSizeHigh=0x8fe728*=0x0) returned 0x4ee2 [0076.325] ReadFile (in: hFile=0x2d0, lpBuffer=0x27e7f24, nNumberOfBytesToRead=0x4ee2, lpNumberOfBytesRead=0x8fe6d4, lpOverlapped=0x0 | out: lpBuffer=0x27e7f24*, lpNumberOfBytesRead=0x8fe6d4*=0x4ee2, lpOverlapped=0x0) returned 1 [0076.325] CloseHandle (hObject=0x2d0) returned 1 [0076.405] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif", nBufferLength=0x105, lpBuffer=0x8fe0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif", lpFilePart=0x0) returned 0x50 [0076.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe614) returned 1 [0076.405] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\he-wdoe.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.406] GetFileType (hFile=0x2d0) returned 0x1 [0076.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe610) returned 1 [0076.406] GetFileType (hFile=0x2d0) returned 0x1 [0076.406] WriteFile (in: hFile=0x2d0, lpBuffer=0x284d7d8*, nNumberOfBytesToWrite=0x4ef0, lpNumberOfBytesWritten=0x8fe6c4, lpOverlapped=0x0 | out: lpBuffer=0x284d7d8*, lpNumberOfBytesWritten=0x8fe6c4*=0x4ef0, lpOverlapped=0x0) returned 1 [0076.407] CloseHandle (hObject=0x2d0) returned 1 [0076.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif", lpFilePart=0x0) returned 0x50 [0076.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x7b [0076.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6ac) returned 1 [0076.410] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\he-wdoe.gif"), fInfoLevelId=0x0, lpFileInformation=0x8fe728 | out: lpFileInformation=0x8fe728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4f396b0, ftCreationTime.dwHighDateTime=0x1d62e37, ftLastAccessTime.dwLowDateTime=0x836722d0, ftLastAccessTime.dwHighDateTime=0x1d62589, ftLastWriteTime.dwLowDateTime=0x899970df, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4ef0)) returned 1 [0076.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6a8) returned 1 [0076.410] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\he-wdoe.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\HE-WDoE.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\he-wdoe.gif.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png", nBufferLength=0x105, lpBuffer=0x8fe0e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png", lpFilePart=0x0) returned 0x55 [0076.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe62c) returned 1 [0076.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\pjk40crasere.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.411] GetFileType (hFile=0x2d0) returned 0x1 [0076.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe628) returned 1 [0076.411] GetFileType (hFile=0x2d0) returned 0x1 [0076.411] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe728 | out: lpFileSizeHigh=0x8fe728*=0x0) returned 0xa86d [0076.411] ReadFile (in: hFile=0x2d0, lpBuffer=0x2852c58, nNumberOfBytesToRead=0xa86d, lpNumberOfBytesRead=0x8fe6d4, lpOverlapped=0x0 | out: lpBuffer=0x2852c58*, lpNumberOfBytesRead=0x8fe6d4*=0xa86d, lpOverlapped=0x0) returned 1 [0076.412] CloseHandle (hObject=0x2d0) returned 1 [0076.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png", nBufferLength=0x105, lpBuffer=0x8fe0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png", lpFilePart=0x0) returned 0x55 [0076.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe614) returned 1 [0076.428] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\pjk40crasere.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.429] GetFileType (hFile=0x2d0) returned 0x1 [0076.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe610) returned 1 [0076.429] GetFileType (hFile=0x2d0) returned 0x1 [0076.429] WriteFile (in: hFile=0x2d0, lpBuffer=0x28bf3c0*, nNumberOfBytesToWrite=0xa870, lpNumberOfBytesWritten=0x8fe6c4, lpOverlapped=0x0 | out: lpBuffer=0x28bf3c0*, lpNumberOfBytesWritten=0x8fe6c4*=0xa870, lpOverlapped=0x0) returned 1 [0076.430] CloseHandle (hObject=0x2d0) returned 1 [0076.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png", lpFilePart=0x0) returned 0x55 [0076.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x80 [0076.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6ac) returned 1 [0076.432] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\pjk40crasere.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe728 | out: lpFileInformation=0x8fe728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5df67be0, ftCreationTime.dwHighDateTime=0x1d628b3, ftLastAccessTime.dwLowDateTime=0xf1f60340, ftLastAccessTime.dwHighDateTime=0x1d62b53, ftLastWriteTime.dwLowDateTime=0x899bd45f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa870)) returned 1 [0076.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6a8) returned 1 [0076.432] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\pjk40crasere.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\pJK40crasERE.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\ch_w8mumw-s\\wg19flh wf\\pjk40crasere.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0076.432] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf", nBufferLength=0x105, lpBuffer=0x8fe1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf", lpFilePart=0x0) returned 0x44 [0076.432] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\CH_w8MUMw-S\\WG19FLh Wf\\*", lpFindFileData=0x8fe44c | out: lpFindFileData=0x8fe44c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e1300, ftCreationTime.dwHighDateTime=0x1d624b1, ftLastAccessTime.dwLowDateTime=0x899bd45f, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x899bd45f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0076.433] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8e1300, ftCreationTime.dwHighDateTime=0x1d624b1, ftLastAccessTime.dwLowDateTime=0x899bd45f, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x899bd45f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.433] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0681a70, ftCreationTime.dwHighDateTime=0x1d6320f, ftLastAccessTime.dwLowDateTime=0xe10056a0, ftLastAccessTime.dwHighDateTime=0x1d623ef, ftLastWriteTime.dwLowDateTime=0x898b3ec0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bg0A1R.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="BG0A1R~1.MAD")) returned 1 [0076.433] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4f396b0, ftCreationTime.dwHighDateTime=0x1d62e37, ftLastAccessTime.dwLowDateTime=0x836722d0, ftLastAccessTime.dwHighDateTime=0x1d62589, ftLastWriteTime.dwLowDateTime=0x899970df, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HE-WDoE.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HE-WDO~1.MAD")) returned 1 [0076.433] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5df67be0, ftCreationTime.dwHighDateTime=0x1d628b3, ftLastAccessTime.dwLowDateTime=0xf1f60340, ftLastAccessTime.dwHighDateTime=0x1d62b53, ftLastWriteTime.dwLowDateTime=0x899bd45f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa870, dwReserved0=0x0, dwReserved1=0x0, cFileName="pJK40crasERE.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="PJK40C~1.MAD")) returned 1 [0076.433] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe458 | out: lpFindFileData=0x8fe458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5df67be0, ftCreationTime.dwHighDateTime=0x1d628b3, ftLastAccessTime.dwLowDateTime=0xf1f60340, ftLastAccessTime.dwHighDateTime=0x1d62b53, ftLastWriteTime.dwLowDateTime=0x899bd45f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa870, dwReserved0=0x0, dwReserved1=0x0, cFileName="pJK40crasERE.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="PJK40C~1.MAD")) returned 0 [0076.433] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0076.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6e0) returned 1 [0076.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0076.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5", nBufferLength=0x105, lpBuffer=0x8fe250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5", lpFilePart=0x0) returned 0x33 [0076.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0076.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5", lpFilePart=0x0) returned 0x33 [0076.434] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34451f50, ftCreationTime.dwHighDateTime=0x1d627fe, ftLastAccessTime.dwLowDateTime=0xc17d6be0, ftLastAccessTime.dwHighDateTime=0x1d632b5, ftLastWriteTime.dwLowDateTime=0xc17d6be0, ftLastWriteTime.dwHighDateTime=0x1d632b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1008 [0076.434] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34451f50, ftCreationTime.dwHighDateTime=0x1d627fe, ftLastAccessTime.dwLowDateTime=0xc17d6be0, ftLastAccessTime.dwHighDateTime=0x1d632b5, ftLastWriteTime.dwLowDateTime=0xc17d6be0, ftLastWriteTime.dwHighDateTime=0x1d632b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.434] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba6bb80, ftCreationTime.dwHighDateTime=0x1d622eb, ftLastAccessTime.dwLowDateTime=0xfca180d0, ftLastAccessTime.dwHighDateTime=0x1d62473, ftLastWriteTime.dwLowDateTime=0xfca180d0, ftLastWriteTime.dwHighDateTime=0x1d62473, nFileSizeHigh=0x0, nFileSizeLow=0x13791, dwReserved0=0x0, dwReserved1=0x0, cFileName="0JSXYdvrd.gif", cAlternateFileName="0JSXYD~1.GIF")) returned 1 [0076.434] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bfa590, ftCreationTime.dwHighDateTime=0x1d623ca, ftLastAccessTime.dwLowDateTime=0x6bc2bf0, ftLastAccessTime.dwHighDateTime=0x1d6305f, ftLastWriteTime.dwLowDateTime=0x6bc2bf0, ftLastWriteTime.dwHighDateTime=0x1d6305f, nFileSizeHigh=0x0, nFileSizeLow=0x163d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CWLaQhn44Lt 4cl0q.jpg", cAlternateFileName="CWLAQH~1.JPG")) returned 1 [0076.434] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a53890, ftCreationTime.dwHighDateTime=0x1d626b6, ftLastAccessTime.dwLowDateTime=0x87a6b800, ftLastAccessTime.dwHighDateTime=0x1d63160, ftLastWriteTime.dwLowDateTime=0x87a6b800, ftLastWriteTime.dwHighDateTime=0x1d63160, nFileSizeHigh=0x0, nFileSizeLow=0x15c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xwn3L4Y.png", cAlternateFileName="")) returned 1 [0076.434] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.434] FindClose (in: hFindFile=0xac1008 | out: hFindFile=0xac1008) returned 1 [0076.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0076.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0076.434] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif", lpFilePart=0x0) returned 0x41 [0076.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0076.434] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\0jsxydvrd.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.435] GetFileType (hFile=0x2d0) returned 0x1 [0076.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0076.435] GetFileType (hFile=0x2d0) returned 0x1 [0076.435] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x13791 [0076.435] ReadFile (in: hFile=0x2d0, lpBuffer=0x28cc174, nNumberOfBytesToRead=0x13791, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x28cc174*, lpNumberOfBytesRead=0x8fe718*=0x13791, lpOverlapped=0x0) returned 1 [0076.435] CloseHandle (hObject=0x2d0) returned 1 [0076.520] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif", lpFilePart=0x0) returned 0x41 [0076.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0076.520] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\0jsxydvrd.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.521] GetFileType (hFile=0x2d0) returned 0x1 [0076.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0076.521] GetFileType (hFile=0x2d0) returned 0x1 [0076.521] WriteFile (in: hFile=0x2d0, lpBuffer=0x2767520*, nNumberOfBytesToWrite=0x137a0, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x2767520*, lpNumberOfBytesWritten=0x8fe708*=0x137a0, lpOverlapped=0x0) returned 1 [0076.523] CloseHandle (hObject=0x2d0) returned 1 [0076.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif", lpFilePart=0x0) returned 0x41 [0076.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6c [0076.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0076.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\0jsxydvrd.gif"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba6bb80, ftCreationTime.dwHighDateTime=0x1d622eb, ftLastAccessTime.dwLowDateTime=0xfca180d0, ftLastAccessTime.dwHighDateTime=0x1d62473, ftLastWriteTime.dwLowDateTime=0x89aa225c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x137a0)) returned 1 [0076.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0076.525] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\0jsxydvrd.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\0JSXYdvrd.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\0jsxydvrd.gif.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.567] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg", lpFilePart=0x0) returned 0x49 [0076.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0076.568] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\cwlaqhn44lt 4cl0q.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.568] GetFileType (hFile=0x2d0) returned 0x1 [0076.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0076.568] GetFileType (hFile=0x2d0) returned 0x1 [0076.568] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x163d6 [0076.568] ReadFile (in: hFile=0x2d0, lpBuffer=0x3705908, nNumberOfBytesToRead=0x163d6, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x3705908*, lpNumberOfBytesRead=0x8fe718*=0x163d6, lpOverlapped=0x0) returned 1 [0076.568] CloseHandle (hObject=0x2d0) returned 1 [0076.587] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg", lpFilePart=0x0) returned 0x49 [0076.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0076.587] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\cwlaqhn44lt 4cl0q.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.588] GetFileType (hFile=0x2d0) returned 0x1 [0076.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0076.588] GetFileType (hFile=0x2d0) returned 0x1 [0076.588] WriteFile (in: hFile=0x2d0, lpBuffer=0x3774ca0*, nNumberOfBytesToWrite=0x163e0, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x3774ca0*, lpNumberOfBytesWritten=0x8fe708*=0x163e0, lpOverlapped=0x0) returned 1 [0076.590] CloseHandle (hObject=0x2d0) returned 1 [0076.592] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg", lpFilePart=0x0) returned 0x49 [0076.592] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x74 [0076.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0076.592] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\cwlaqhn44lt 4cl0q.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bfa590, ftCreationTime.dwHighDateTime=0x1d623ca, ftLastAccessTime.dwLowDateTime=0x6bc2bf0, ftLastAccessTime.dwHighDateTime=0x1d6305f, ftLastWriteTime.dwLowDateTime=0x89b3ac2b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x163e0)) returned 1 [0076.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0076.592] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\cwlaqhn44lt 4cl0q.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\CWLaQhn44Lt 4cl0q.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\cwlaqhn44lt 4cl0q.jpg.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.593] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png", lpFilePart=0x0) returned 0x3f [0076.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0076.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\xwn3l4y.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.593] GetFileType (hFile=0x2d0) returned 0x1 [0076.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0076.593] GetFileType (hFile=0x2d0) returned 0x1 [0076.593] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x15c6 [0076.593] ReadFile (in: hFile=0x2d0, lpBuffer=0x27c866c, nNumberOfBytesToRead=0x15c6, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x27c866c*, lpNumberOfBytesRead=0x8fe718*=0x15c6, lpOverlapped=0x0) returned 1 [0076.593] CloseHandle (hObject=0x2d0) returned 1 [0076.609] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png", lpFilePart=0x0) returned 0x3f [0076.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0076.609] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\xwn3l4y.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.609] GetFileType (hFile=0x2d0) returned 0x1 [0076.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0076.609] GetFileType (hFile=0x2d0) returned 0x1 [0076.609] WriteFile (in: hFile=0x2d0, lpBuffer=0x281c180*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x281c180*, lpNumberOfBytesWritten=0x8fe708*=0x15d0, lpOverlapped=0x0) returned 1 [0076.659] CloseHandle (hObject=0x2d0) returned 1 [0076.660] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png", lpFilePart=0x0) returned 0x3f [0076.660] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6a [0076.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0076.660] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\xwn3l4y.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a53890, ftCreationTime.dwHighDateTime=0x1d626b6, ftLastAccessTime.dwLowDateTime=0x87a6b800, ftLastAccessTime.dwHighDateTime=0x1d63160, ftLastWriteTime.dwLowDateTime=0x89bf97b8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15d0)) returned 1 [0076.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0076.660] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\xwn3l4y.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\Xwn3L4Y.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\e7 bc7vgmqwxtl6uptsb\\yvqc5\\xwn3l4y.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0076.661] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5", lpFilePart=0x0) returned 0x33 [0076.661] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\E7 bC7VGmQwxtl6UPTSb\\YVQC5\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34451f50, ftCreationTime.dwHighDateTime=0x1d627fe, ftLastAccessTime.dwLowDateTime=0x89bf97b8, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x89bf97b8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1208 [0076.661] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34451f50, ftCreationTime.dwHighDateTime=0x1d627fe, ftLastAccessTime.dwLowDateTime=0x89bf97b8, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x89bf97b8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.662] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba6bb80, ftCreationTime.dwHighDateTime=0x1d622eb, ftLastAccessTime.dwLowDateTime=0xfca180d0, ftLastAccessTime.dwHighDateTime=0x1d62473, ftLastWriteTime.dwLowDateTime=0x89aa225c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x137a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0JSXYdvrd.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="0JSXYD~1.MAD")) returned 1 [0076.662] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bfa590, ftCreationTime.dwHighDateTime=0x1d623ca, ftLastAccessTime.dwLowDateTime=0x6bc2bf0, ftLastAccessTime.dwHighDateTime=0x1d6305f, ftLastWriteTime.dwLowDateTime=0x89b3ac2b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x163e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CWLaQhn44Lt 4cl0q.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="CWLAQH~1.MAD")) returned 1 [0076.662] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a53890, ftCreationTime.dwHighDateTime=0x1d626b6, ftLastAccessTime.dwLowDateTime=0x87a6b800, ftLastAccessTime.dwHighDateTime=0x1d63160, ftLastWriteTime.dwLowDateTime=0x89bf97b8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xwn3L4Y.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="XWN3L4~1.MAD")) returned 1 [0076.662] FindNextFileW (in: hFindFile=0xac1208, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a53890, ftCreationTime.dwHighDateTime=0x1d626b6, ftLastAccessTime.dwLowDateTime=0x87a6b800, ftLastAccessTime.dwHighDateTime=0x1d63160, ftLastWriteTime.dwLowDateTime=0x89bf97b8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xwn3L4Y.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="XWN3L4~1.MAD")) returned 0 [0076.662] FindClose (in: hFindFile=0xac1208 | out: hFindFile=0xac1208) returned 1 [0076.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0076.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0076.662] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14", lpFilePart=0x0) returned 0x1e [0076.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0076.662] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14", lpFilePart=0x0) returned 0x1e [0076.662] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8fbc940, ftCreationTime.dwHighDateTime=0x1d631c5, ftLastAccessTime.dwLowDateTime=0x47ad7980, ftLastAccessTime.dwHighDateTime=0x1d62c08, ftLastWriteTime.dwLowDateTime=0x47ad7980, ftLastWriteTime.dwHighDateTime=0x1d62c08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e88 [0076.663] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8fbc940, ftCreationTime.dwHighDateTime=0x1d631c5, ftLastAccessTime.dwLowDateTime=0x47ad7980, ftLastAccessTime.dwHighDateTime=0x1d62c08, ftLastWriteTime.dwLowDateTime=0x47ad7980, ftLastWriteTime.dwHighDateTime=0x1d62c08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.663] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3366ead0, ftCreationTime.dwHighDateTime=0x1d62c10, ftLastAccessTime.dwLowDateTime=0xcb2ba5f0, ftLastAccessTime.dwHighDateTime=0x1d6286d, ftLastWriteTime.dwLowDateTime=0xcb2ba5f0, ftLastWriteTime.dwHighDateTime=0x1d6286d, nFileSizeHigh=0x0, nFileSizeLow=0xa32, dwReserved0=0x0, dwReserved1=0x0, cFileName="f1aQaKT1E3Fk.bmp", cAlternateFileName="F1AQAK~1.BMP")) returned 1 [0076.663] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7229efd0, ftCreationTime.dwHighDateTime=0x1d62d21, ftLastAccessTime.dwLowDateTime=0x1a444b80, ftLastAccessTime.dwHighDateTime=0x1d625b5, ftLastWriteTime.dwLowDateTime=0x1a444b80, ftLastWriteTime.dwHighDateTime=0x1d625b5, nFileSizeHigh=0x0, nFileSizeLow=0xca0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hd0RT.bmp", cAlternateFileName="")) returned 1 [0076.663] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee388cb0, ftCreationTime.dwHighDateTime=0x1d625da, ftLastAccessTime.dwLowDateTime=0x47ee37d0, ftLastAccessTime.dwHighDateTime=0x1d63041, ftLastWriteTime.dwLowDateTime=0x47ee37d0, ftLastWriteTime.dwHighDateTime=0x1d63041, nFileSizeHigh=0x0, nFileSizeLow=0xe2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwGUFQg_XL.png", cAlternateFileName="TWGUFQ~1.PNG")) returned 1 [0076.663] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9eb620, ftCreationTime.dwHighDateTime=0x1d62c1f, ftLastAccessTime.dwLowDateTime=0xde5387c0, ftLastAccessTime.dwHighDateTime=0x1d63235, ftLastWriteTime.dwLowDateTime=0xde5387c0, ftLastWriteTime.dwHighDateTime=0x1d63235, nFileSizeHigh=0x0, nFileSizeLow=0xb128, dwReserved0=0x0, dwReserved1=0x0, cFileName="xrbifJ.jpg", cAlternateFileName="")) returned 1 [0076.663] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.663] FindClose (in: hFindFile=0xac0e88 | out: hFindFile=0xac0e88) returned 1 [0076.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0076.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0076.663] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp", lpFilePart=0x0) returned 0x2f [0076.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0076.663] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\f1aqakt1e3fk.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.663] GetFileType (hFile=0x2d0) returned 0x1 [0076.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0076.664] GetFileType (hFile=0x2d0) returned 0x1 [0076.664] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xa32 [0076.664] ReadFile (in: hFile=0x2d0, lpBuffer=0x2820274, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2820274*, lpNumberOfBytesRead=0x8fe75c*=0xa32, lpOverlapped=0x0) returned 1 [0076.664] CloseHandle (hObject=0x2d0) returned 1 [0076.679] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp", lpFilePart=0x0) returned 0x2f [0076.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0076.679] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\f1aqakt1e3fk.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.680] GetFileType (hFile=0x2d0) returned 0x1 [0076.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0076.680] GetFileType (hFile=0x2d0) returned 0x1 [0076.680] WriteFile (in: hFile=0x2d0, lpBuffer=0x28714c8*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x8fe720, lpOverlapped=0x0 | out: lpBuffer=0x28714c8*, lpNumberOfBytesWritten=0x8fe720*=0xa40, lpOverlapped=0x0) returned 1 [0076.681] CloseHandle (hObject=0x2d0) returned 1 [0076.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp", lpFilePart=0x0) returned 0x2f [0076.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5a [0076.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0076.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\f1aqakt1e3fk.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3366ead0, ftCreationTime.dwHighDateTime=0x1d62c10, ftLastAccessTime.dwLowDateTime=0xcb2ba5f0, ftLastAccessTime.dwHighDateTime=0x1d6286d, ftLastWriteTime.dwLowDateTime=0x89c1fa1b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa40)) returned 1 [0076.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0076.682] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\f1aqakt1e3fk.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\f1aQaKT1E3Fk.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\f1aqakt1e3fk.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp", lpFilePart=0x0) returned 0x28 [0076.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0076.682] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\hd0rt.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.682] GetFileType (hFile=0x2d0) returned 0x1 [0076.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0076.683] GetFileType (hFile=0x2d0) returned 0x1 [0076.683] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xca0a [0076.683] ReadFile (in: hFile=0x2d0, lpBuffer=0x28727fc, nNumberOfBytesToRead=0xca0a, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28727fc*, lpNumberOfBytesRead=0x8fe75c*=0xca0a, lpOverlapped=0x0) returned 1 [0076.683] CloseHandle (hObject=0x2d0) returned 1 [0076.700] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp", lpFilePart=0x0) returned 0x28 [0076.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0076.700] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\hd0rt.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.701] GetFileType (hFile=0x2d0) returned 0x1 [0076.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0076.701] GetFileType (hFile=0x2d0) returned 0x1 [0076.701] WriteFile (in: hFile=0x2d0, lpBuffer=0x28e5444*, nNumberOfBytesToWrite=0xca10, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28e5444*, lpNumberOfBytesWritten=0x8fe74c*=0xca10, lpOverlapped=0x0) returned 1 [0076.702] CloseHandle (hObject=0x2d0) returned 1 [0076.703] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp", lpFilePart=0x0) returned 0x28 [0076.703] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x53 [0076.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0076.704] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\hd0rt.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7229efd0, ftCreationTime.dwHighDateTime=0x1d62d21, ftLastAccessTime.dwLowDateTime=0x1a444b80, ftLastAccessTime.dwHighDateTime=0x1d625b5, ftLastWriteTime.dwLowDateTime=0x89c45d76, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xca10)) returned 1 [0076.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0076.704] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\hd0rt.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\hd0RT.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\hd0rt.bmp.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.752] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png", lpFilePart=0x0) returned 0x2d [0076.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0076.752] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\twgufqg_xl.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.752] GetFileType (hFile=0x2d0) returned 0x1 [0076.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0076.753] GetFileType (hFile=0x2d0) returned 0x1 [0076.753] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xe2cc [0076.753] ReadFile (in: hFile=0x2d0, lpBuffer=0x28f224c, nNumberOfBytesToRead=0xe2cc, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28f224c*, lpNumberOfBytesRead=0x8fe75c*=0xe2cc, lpOverlapped=0x0) returned 1 [0076.753] CloseHandle (hObject=0x2d0) returned 1 [0076.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png", lpFilePart=0x0) returned 0x2d [0076.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0076.789] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\twgufqg_xl.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.790] GetFileType (hFile=0x2d0) returned 0x1 [0076.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0076.790] GetFileType (hFile=0x2d0) returned 0x1 [0076.790] WriteFile (in: hFile=0x2d0, lpBuffer=0x27765a4*, nNumberOfBytesToWrite=0xe2d0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27765a4*, lpNumberOfBytesWritten=0x8fe74c*=0xe2d0, lpOverlapped=0x0) returned 1 [0076.791] CloseHandle (hObject=0x2d0) returned 1 [0076.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png", lpFilePart=0x0) returned 0x2d [0076.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x58 [0076.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0076.793] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\twgufqg_xl.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee388cb0, ftCreationTime.dwHighDateTime=0x1d625da, ftLastAccessTime.dwLowDateTime=0x47ee37d0, ftLastAccessTime.dwHighDateTime=0x1d63041, ftLastWriteTime.dwLowDateTime=0x89d2a9b8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe2d0)) returned 1 [0076.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0076.794] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\twgufqg_xl.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\TwGUFQg_XL.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\twgufqg_xl.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.794] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg", lpFilePart=0x0) returned 0x29 [0076.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0076.794] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\xrbifj.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.794] GetFileType (hFile=0x2d0) returned 0x1 [0076.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0076.794] GetFileType (hFile=0x2d0) returned 0x1 [0076.795] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xb128 [0076.795] ReadFile (in: hFile=0x2d0, lpBuffer=0x2784c90, nNumberOfBytesToRead=0xb128, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2784c90*, lpNumberOfBytesRead=0x8fe75c*=0xb128, lpOverlapped=0x0) returned 1 [0076.795] CloseHandle (hObject=0x2d0) returned 1 [0076.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg", lpFilePart=0x0) returned 0x29 [0076.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0076.870] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\xrbifj.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.871] GetFileType (hFile=0x2d0) returned 0x1 [0076.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0076.871] GetFileType (hFile=0x2d0) returned 0x1 [0076.871] WriteFile (in: hFile=0x2d0, lpBuffer=0x27f2f90*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27f2f90*, lpNumberOfBytesWritten=0x8fe74c*=0xb130, lpOverlapped=0x0) returned 1 [0076.872] CloseHandle (hObject=0x2d0) returned 1 [0076.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg", lpFilePart=0x0) returned 0x29 [0076.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x54 [0076.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0076.874] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\xrbifj.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9eb620, ftCreationTime.dwHighDateTime=0x1d62c1f, ftLastAccessTime.dwLowDateTime=0xde5387c0, ftLastAccessTime.dwHighDateTime=0x1d63235, ftLastWriteTime.dwLowDateTime=0x89de9596, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xb130)) returned 1 [0076.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0076.874] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\xrbifj.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\xrbifJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\pictures\\gaa14\\xrbifj.jpg.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0076.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\gaA14", lpFilePart=0x0) returned 0x1e [0076.875] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gaA14\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8fbc940, ftCreationTime.dwHighDateTime=0x1d631c5, ftLastAccessTime.dwLowDateTime=0x89de9596, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x89de9596, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1548 [0076.875] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8fbc940, ftCreationTime.dwHighDateTime=0x1d631c5, ftLastAccessTime.dwLowDateTime=0x89de9596, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x89de9596, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.875] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3366ead0, ftCreationTime.dwHighDateTime=0x1d62c10, ftLastAccessTime.dwLowDateTime=0xcb2ba5f0, ftLastAccessTime.dwHighDateTime=0x1d6286d, ftLastWriteTime.dwLowDateTime=0x89c1fa1b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="f1aQaKT1E3Fk.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="F1AQAK~1.MAD")) returned 1 [0076.875] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7229efd0, ftCreationTime.dwHighDateTime=0x1d62d21, ftLastAccessTime.dwLowDateTime=0x1a444b80, ftLastAccessTime.dwHighDateTime=0x1d625b5, ftLastWriteTime.dwLowDateTime=0x89c45d76, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xca10, dwReserved0=0x0, dwReserved1=0x0, cFileName="hd0RT.bmp.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HD0RTB~1.MAD")) returned 1 [0076.875] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee388cb0, ftCreationTime.dwHighDateTime=0x1d625da, ftLastAccessTime.dwLowDateTime=0x47ee37d0, ftLastAccessTime.dwHighDateTime=0x1d63041, ftLastWriteTime.dwLowDateTime=0x89d2a9b8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwGUFQg_XL.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="TWGUFQ~1.MAD")) returned 1 [0076.876] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9eb620, ftCreationTime.dwHighDateTime=0x1d62c1f, ftLastAccessTime.dwLowDateTime=0xde5387c0, ftLastAccessTime.dwHighDateTime=0x1d63235, ftLastWriteTime.dwLowDateTime=0x89de9596, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xb130, dwReserved0=0x0, dwReserved1=0x0, cFileName="xrbifJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="XRBIFJ~1.MAD")) returned 1 [0076.876] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9eb620, ftCreationTime.dwHighDateTime=0x1d62c1f, ftLastAccessTime.dwLowDateTime=0xde5387c0, ftLastAccessTime.dwHighDateTime=0x1d63235, ftLastWriteTime.dwLowDateTime=0x89de9596, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xb130, dwReserved0=0x0, dwReserved1=0x0, cFileName="xrbifJ.jpg.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="XRBIFJ~1.MAD")) returned 0 [0076.878] FindClose (in: hFindFile=0xac1548 | out: hFindFile=0xac1548) returned 1 [0076.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0076.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0076.879] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0076.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0076.879] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0076.879] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1008 [0076.881] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.881] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.881] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.881] FindClose (in: hFindFile=0xac1008 | out: hFindFile=0xac1008) returned 1 [0076.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0076.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0076.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0076.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0076.882] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0076.882] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.882] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.882] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0076.882] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0076.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0076.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0076.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b [0076.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0076.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b [0076.882] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f88 [0076.883] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.883] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.883] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.883] FindClose (in: hFindFile=0xac0f88 | out: hFindFile=0xac0f88) returned 1 [0076.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0076.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0076.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0076.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b [0076.883] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0076.883] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.883] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.883] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0076.884] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0076.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0076.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0076.884] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18 [0076.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0076.884] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18 [0076.884] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1248 [0076.884] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.884] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.884] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0076.884] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0076.884] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0076.885] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.885] FindClose (in: hFindFile=0xac1248 | out: hFindFile=0xac1248) returned 1 [0076.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0076.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0076.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0076.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18 [0076.885] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f88 [0076.885] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.885] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.885] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0076.885] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0076.886] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0076.886] FindNextFileW (in: hFindFile=0xac0f88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0076.886] FindClose (in: hFindFile=0xac0f88 | out: hFindFile=0xac0f88) returned 1 [0076.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0076.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0076.886] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0076.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0076.886] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0076.886] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf9855da, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf9855da, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0076.886] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf9855da, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xf9855da, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.886] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54311ab0, ftCreationTime.dwHighDateTime=0x1d63066, ftLastAccessTime.dwLowDateTime=0x2781ec10, ftLastAccessTime.dwHighDateTime=0x1d627dd, ftLastWriteTime.dwLowDateTime=0x2781ec10, ftLastWriteTime.dwHighDateTime=0x1d627dd, nFileSizeHigh=0x0, nFileSizeLow=0x10e66, dwReserved0=0x0, dwReserved1=0x0, cFileName="0GxO-atSGdfuD_nb-.swf", cAlternateFileName="0GXO-A~1.SWF")) returned 1 [0076.886] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12cfe740, ftCreationTime.dwHighDateTime=0x1d6276a, ftLastAccessTime.dwLowDateTime=0x769d2ea0, ftLastAccessTime.dwHighDateTime=0x1d62822, ftLastWriteTime.dwLowDateTime=0x769d2ea0, ftLastWriteTime.dwHighDateTime=0x1d62822, nFileSizeHigh=0x0, nFileSizeLow=0x17c10, dwReserved0=0x0, dwReserved1=0x0, cFileName="3PHmmYDpfwfx7H.mp4", cAlternateFileName="3PHMMY~1.MP4")) returned 1 [0076.887] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dbf230, ftCreationTime.dwHighDateTime=0x1d624d8, ftLastAccessTime.dwLowDateTime=0x635c7190, ftLastAccessTime.dwHighDateTime=0x1d62b27, ftLastWriteTime.dwLowDateTime=0x635c7190, ftLastWriteTime.dwHighDateTime=0x1d62b27, nFileSizeHigh=0x0, nFileSizeLow=0x16c85, dwReserved0=0x0, dwReserved1=0x0, cFileName="bJhvjZj5PJ9feE3_B.mp4", cAlternateFileName="BJHVJZ~1.MP4")) returned 1 [0076.887] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28221730, ftCreationTime.dwHighDateTime=0x1d624bd, ftLastAccessTime.dwLowDateTime=0xc2407510, ftLastAccessTime.dwHighDateTime=0x1d624d0, ftLastWriteTime.dwLowDateTime=0xc2407510, ftLastWriteTime.dwHighDateTime=0x1d624d0, nFileSizeHigh=0x0, nFileSizeLow=0x116d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bVdG y.swf", cAlternateFileName="BVDGY~1.SWF")) returned 1 [0076.887] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.887] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaff14080, ftCreationTime.dwHighDateTime=0x1d62870, ftLastAccessTime.dwLowDateTime=0x604b61d0, ftLastAccessTime.dwHighDateTime=0x1d623a4, ftLastWriteTime.dwLowDateTime=0x604b61d0, ftLastWriteTime.dwHighDateTime=0x1d623a4, nFileSizeHigh=0x0, nFileSizeLow=0x3097, dwReserved0=0x0, dwReserved1=0x0, cFileName="F65O.flv", cAlternateFileName="")) returned 1 [0076.887] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a6fb3f0, ftCreationTime.dwHighDateTime=0x1d62d9a, ftLastAccessTime.dwLowDateTime=0xc01ca400, ftLastAccessTime.dwHighDateTime=0x1d62d7e, ftLastWriteTime.dwLowDateTime=0xc01ca400, ftLastWriteTime.dwHighDateTime=0x1d62d7e, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="hC0AvAmwba.flv", cAlternateFileName="HC0AVA~1.FLV")) returned 1 [0076.887] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73428170, ftCreationTime.dwHighDateTime=0x1d62c81, ftLastAccessTime.dwLowDateTime=0x3554d6b0, ftLastAccessTime.dwHighDateTime=0x1d622d1, ftLastWriteTime.dwLowDateTime=0x3554d6b0, ftLastWriteTime.dwHighDateTime=0x1d622d1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JQscOqa4VudNzL", cAlternateFileName="JQSCOQ~1")) returned 1 [0076.887] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4646280, ftCreationTime.dwHighDateTime=0x1d624fc, ftLastAccessTime.dwLowDateTime=0x48eeec70, ftLastAccessTime.dwHighDateTime=0x1d62e74, ftLastWriteTime.dwLowDateTime=0x48eeec70, ftLastWriteTime.dwHighDateTime=0x1d62e74, nFileSizeHigh=0x0, nFileSizeLow=0xb7af, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWkdHlKqUxbJlw3.mkv", cAlternateFileName="RWKDHL~1.MKV")) returned 1 [0076.887] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f2ab80, ftCreationTime.dwHighDateTime=0x1d627ff, ftLastAccessTime.dwLowDateTime=0xdd0deb00, ftLastAccessTime.dwHighDateTime=0x1d62f59, ftLastWriteTime.dwLowDateTime=0xdd0deb00, ftLastWriteTime.dwHighDateTime=0x1d62f59, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VrjM2gUeZLzouOH", cAlternateFileName="VRJM2G~1")) returned 1 [0076.887] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57537230, ftCreationTime.dwHighDateTime=0x1d627c7, ftLastAccessTime.dwLowDateTime=0x9f7c2f50, ftLastAccessTime.dwHighDateTime=0x1d6245e, ftLastWriteTime.dwLowDateTime=0x9f7c2f50, ftLastWriteTime.dwHighDateTime=0x1d6245e, nFileSizeHigh=0x0, nFileSizeLow=0xa935, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xmz5xDFkdqyDo.mp4", cAlternateFileName="XMZ5XD~1.MP4")) returned 1 [0076.887] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.887] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0076.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0076.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0076.888] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf", lpFilePart=0x0) returned 0x2c [0076.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0076.888] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf" (normalized: "c:\\users\\fd1hvy\\videos\\0gxo-atsgdfud_nb-.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.888] GetFileType (hFile=0x2d0) returned 0x1 [0076.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0076.888] GetFileType (hFile=0x2d0) returned 0x1 [0076.888] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x10e66 [0076.888] ReadFile (in: hFile=0x2d0, lpBuffer=0x2804330, nNumberOfBytesToRead=0x10e66, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2804330*, lpNumberOfBytesRead=0x8fe7a0*=0x10e66, lpOverlapped=0x0) returned 1 [0076.889] CloseHandle (hObject=0x2d0) returned 1 [0076.906] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf", lpFilePart=0x0) returned 0x2c [0076.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0076.906] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf" (normalized: "c:\\users\\fd1hvy\\videos\\0gxo-atsgdfud_nb-.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.958] GetFileType (hFile=0x2d0) returned 0x1 [0076.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0076.959] GetFileType (hFile=0x2d0) returned 0x1 [0076.959] WriteFile (in: hFile=0x2d0, lpBuffer=0x2883c98*, nNumberOfBytesToWrite=0x10e70, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2883c98*, lpNumberOfBytesWritten=0x8fe790*=0x10e70, lpOverlapped=0x0) returned 1 [0076.960] CloseHandle (hObject=0x2d0) returned 1 [0076.962] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf", lpFilePart=0x0) returned 0x2c [0076.962] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0076.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0076.962] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf" (normalized: "c:\\users\\fd1hvy\\videos\\0gxo-atsgdfud_nb-.swf"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54311ab0, ftCreationTime.dwHighDateTime=0x1d63066, ftLastAccessTime.dwLowDateTime=0x2781ec10, ftLastAccessTime.dwHighDateTime=0x1d627dd, ftLastWriteTime.dwLowDateTime=0x89ece3e6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10e70)) returned 1 [0076.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0076.962] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf" (normalized: "c:\\users\\fd1hvy\\videos\\0gxo-atsgdfud_nb-.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0GxO-atSGdfuD_nb-.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\0gxo-atsgdfud_nb-.swf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.963] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4", lpFilePart=0x0) returned 0x29 [0076.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0076.963] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\3phmmydpfwfx7h.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.963] GetFileType (hFile=0x2d0) returned 0x1 [0076.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0076.963] GetFileType (hFile=0x2d0) returned 0x1 [0076.963] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x17c10 [0076.963] ReadFile (in: hFile=0x2d0, lpBuffer=0x37f89a0, nNumberOfBytesToRead=0x17c10, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x37f89a0*, lpNumberOfBytesRead=0x8fe7a0*=0x17c10, lpOverlapped=0x0) returned 1 [0076.964] CloseHandle (hObject=0x2d0) returned 1 [0076.984] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4", lpFilePart=0x0) returned 0x29 [0076.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0076.984] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\3phmmydpfwfx7h.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.985] GetFileType (hFile=0x2d0) returned 0x1 [0076.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0076.985] GetFileType (hFile=0x2d0) returned 0x1 [0076.985] WriteFile (in: hFile=0x2d0, lpBuffer=0x386f670*, nNumberOfBytesToWrite=0x17c20, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x386f670*, lpNumberOfBytesWritten=0x8fe790*=0x17c20, lpOverlapped=0x0) returned 1 [0076.987] CloseHandle (hObject=0x2d0) returned 1 [0076.989] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4", lpFilePart=0x0) returned 0x29 [0076.989] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x54 [0076.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0076.989] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\3phmmydpfwfx7h.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12cfe740, ftCreationTime.dwHighDateTime=0x1d6276a, ftLastAccessTime.dwLowDateTime=0x769d2ea0, ftLastAccessTime.dwHighDateTime=0x1d62822, ftLastWriteTime.dwLowDateTime=0x89f1a8d3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x17c20)) returned 1 [0076.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0076.989] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\3phmmydpfwfx7h.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\3PHmmYDpfwfx7H.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\3phmmydpfwfx7h.mp4.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0076.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4", lpFilePart=0x0) returned 0x2c [0076.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0076.990] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\bjhvjzj5pj9fee3_b.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0076.990] GetFileType (hFile=0x2d0) returned 0x1 [0076.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0076.990] GetFileType (hFile=0x2d0) returned 0x1 [0076.990] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x16c85 [0076.991] ReadFile (in: hFile=0x2d0, lpBuffer=0x38872b0, nNumberOfBytesToRead=0x16c85, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x38872b0*, lpNumberOfBytesRead=0x8fe7a0*=0x16c85, lpOverlapped=0x0) returned 1 [0076.991] CloseHandle (hObject=0x2d0) returned 1 [0077.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4", lpFilePart=0x0) returned 0x2c [0077.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0077.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\bjhvjzj5pj9fee3_b.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.176] GetFileType (hFile=0x2d0) returned 0x1 [0077.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0077.176] GetFileType (hFile=0x2d0) returned 0x1 [0077.177] WriteFile (in: hFile=0x2d0, lpBuffer=0x38f91b8*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x38f91b8*, lpNumberOfBytesWritten=0x8fe790*=0x16c90, lpOverlapped=0x0) returned 1 [0077.178] CloseHandle (hObject=0x2d0) returned 1 [0077.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4", lpFilePart=0x0) returned 0x2c [0077.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0077.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0077.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\bjhvjzj5pj9fee3_b.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dbf230, ftCreationTime.dwHighDateTime=0x1d624d8, ftLastAccessTime.dwLowDateTime=0x635c7190, ftLastAccessTime.dwHighDateTime=0x1d62b27, ftLastWriteTime.dwLowDateTime=0x8a0e45f2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16c90)) returned 1 [0077.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0077.180] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\bjhvjzj5pj9fee3_b.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\bJhvjZj5PJ9feE3_B.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\bjhvjzj5pj9fee3_b.mp4.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf", lpFilePart=0x0) returned 0x21 [0077.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0077.181] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf" (normalized: "c:\\users\\fd1hvy\\videos\\bvdg y.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.181] GetFileType (hFile=0x2d0) returned 0x1 [0077.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0077.181] GetFileType (hFile=0x2d0) returned 0x1 [0077.181] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x116d [0077.181] ReadFile (in: hFile=0x2d0, lpBuffer=0x272ff34, nNumberOfBytesToRead=0x116d, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x272ff34*, lpNumberOfBytesRead=0x8fe7a0*=0x116d, lpOverlapped=0x0) returned 1 [0077.182] CloseHandle (hObject=0x2d0) returned 1 [0077.247] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf", lpFilePart=0x0) returned 0x21 [0077.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0077.247] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf" (normalized: "c:\\users\\fd1hvy\\videos\\bvdg y.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.248] GetFileType (hFile=0x2d0) returned 0x1 [0077.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0077.248] GetFileType (hFile=0x2d0) returned 0x1 [0077.248] WriteFile (in: hFile=0x2d0, lpBuffer=0x27825c4*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27825c4*, lpNumberOfBytesWritten=0x8fe790*=0x1170, lpOverlapped=0x0) returned 1 [0077.249] CloseHandle (hObject=0x2d0) returned 1 [0077.250] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf", lpFilePart=0x0) returned 0x21 [0077.250] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4c [0077.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0077.250] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf" (normalized: "c:\\users\\fd1hvy\\videos\\bvdg y.swf"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28221730, ftCreationTime.dwHighDateTime=0x1d624bd, ftLastAccessTime.dwLowDateTime=0xc2407510, ftLastAccessTime.dwHighDateTime=0x1d624d0, ftLastWriteTime.dwLowDateTime=0x8a17cfae, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1170)) returned 1 [0077.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0077.250] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf" (normalized: "c:\\users\\fd1hvy\\videos\\bvdg y.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\bVdG y.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\bvdg y.swf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.251] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\F65O.flv", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\F65O.flv", lpFilePart=0x0) returned 0x1f [0077.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0077.251] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\F65O.flv" (normalized: "c:\\users\\fd1hvy\\videos\\f65o.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.251] GetFileType (hFile=0x2d0) returned 0x1 [0077.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0077.251] GetFileType (hFile=0x2d0) returned 0x1 [0077.251] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x3097 [0077.251] ReadFile (in: hFile=0x2d0, lpBuffer=0x2783ae8, nNumberOfBytesToRead=0x3097, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2783ae8*, lpNumberOfBytesRead=0x8fe7a0*=0x3097, lpOverlapped=0x0) returned 1 [0077.252] CloseHandle (hObject=0x2d0) returned 1 [0077.273] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\F65O.flv", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\F65O.flv", lpFilePart=0x0) returned 0x1f [0077.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0077.274] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\F65O.flv" (normalized: "c:\\users\\fd1hvy\\videos\\f65o.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.275] GetFileType (hFile=0x2d0) returned 0x1 [0077.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0077.275] GetFileType (hFile=0x2d0) returned 0x1 [0077.275] WriteFile (in: hFile=0x2d0, lpBuffer=0x27dfc0c*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27dfc0c*, lpNumberOfBytesWritten=0x8fe790*=0x30a0, lpOverlapped=0x0) returned 1 [0077.276] CloseHandle (hObject=0x2d0) returned 1 [0077.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\F65O.flv", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\F65O.flv", lpFilePart=0x0) returned 0x1f [0077.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\F65O.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\F65O.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x4a [0077.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0077.277] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\F65O.flv" (normalized: "c:\\users\\fd1hvy\\videos\\f65o.flv"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaff14080, ftCreationTime.dwHighDateTime=0x1d62870, ftLastAccessTime.dwLowDateTime=0x604b61d0, ftLastAccessTime.dwHighDateTime=0x1d623a4, ftLastWriteTime.dwLowDateTime=0x8a1c93c4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x30a0)) returned 1 [0077.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0077.277] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\F65O.flv" (normalized: "c:\\users\\fd1hvy\\videos\\f65o.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\F65O.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\f65o.flv.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.278] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv", lpFilePart=0x0) returned 0x25 [0077.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0077.278] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv" (normalized: "c:\\users\\fd1hvy\\videos\\hc0avamwba.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.278] GetFileType (hFile=0x2d0) returned 0x1 [0077.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0077.278] GetFileType (hFile=0x2d0) returned 0x1 [0077.278] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x4ae [0077.278] ReadFile (in: hFile=0x2d0, lpBuffer=0x27e3508, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27e3508*, lpNumberOfBytesRead=0x8fe7a0*=0x4ae, lpOverlapped=0x0) returned 1 [0077.279] CloseHandle (hObject=0x2d0) returned 1 [0077.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv", lpFilePart=0x0) returned 0x25 [0077.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0077.343] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv" (normalized: "c:\\users\\fd1hvy\\videos\\hc0avamwba.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.344] GetFileType (hFile=0x2d0) returned 0x1 [0077.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0077.344] GetFileType (hFile=0x2d0) returned 0x1 [0077.344] WriteFile (in: hFile=0x2d0, lpBuffer=0x2832b68*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x2832b68*, lpNumberOfBytesWritten=0x8fe764*=0x4b0, lpOverlapped=0x0) returned 1 [0077.344] CloseHandle (hObject=0x2d0) returned 1 [0077.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv", lpFilePart=0x0) returned 0x25 [0077.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x50 [0077.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0077.345] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv" (normalized: "c:\\users\\fd1hvy\\videos\\hc0avamwba.flv"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a6fb3f0, ftCreationTime.dwHighDateTime=0x1d62d9a, ftLastAccessTime.dwLowDateTime=0xc01ca400, ftLastAccessTime.dwHighDateTime=0x1d62d7e, ftLastWriteTime.dwLowDateTime=0x8a289329, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4b0)) returned 1 [0077.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0077.346] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv" (normalized: "c:\\users\\fd1hvy\\videos\\hc0avamwba.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\hC0AvAmwba.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\hc0avamwba.flv.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4", lpFilePart=0x0) returned 0x28 [0077.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0077.346] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\xmz5xdfkdqydo.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.346] GetFileType (hFile=0x2d0) returned 0x1 [0077.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0077.346] GetFileType (hFile=0x2d0) returned 0x1 [0077.347] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xa935 [0077.347] ReadFile (in: hFile=0x2d0, lpBuffer=0x2833e88, nNumberOfBytesToRead=0xa935, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2833e88*, lpNumberOfBytesRead=0x8fe7a0*=0xa935, lpOverlapped=0x0) returned 1 [0077.347] CloseHandle (hObject=0x2d0) returned 1 [0077.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4", lpFilePart=0x0) returned 0x28 [0077.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0077.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\xmz5xdfkdqydo.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.365] GetFileType (hFile=0x2d0) returned 0x1 [0077.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0077.365] GetFileType (hFile=0x2d0) returned 0x1 [0077.365] WriteFile (in: hFile=0x2d0, lpBuffer=0x28a0860*, nNumberOfBytesToWrite=0xa940, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x28a0860*, lpNumberOfBytesWritten=0x8fe790*=0xa940, lpOverlapped=0x0) returned 1 [0077.366] CloseHandle (hObject=0x2d0) returned 1 [0077.368] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4", lpFilePart=0x0) returned 0x28 [0077.368] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x53 [0077.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0077.368] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\xmz5xdfkdqydo.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57537230, ftCreationTime.dwHighDateTime=0x1d627c7, ftLastAccessTime.dwLowDateTime=0x9f7c2f50, ftLastAccessTime.dwHighDateTime=0x1d6245e, ftLastWriteTime.dwLowDateTime=0x8a2ae1ee, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa940)) returned 1 [0077.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0077.368] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\xmz5xdfkdqydo.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Xmz5xDFkdqyDo.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\xmz5xdfkdqydo.mp4.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0077.369] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0077.369] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8a2ae1ee, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8a2ae1ee, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1308 [0077.369] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8a2ae1ee, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8a2ae1ee, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.369] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54311ab0, ftCreationTime.dwHighDateTime=0x1d63066, ftLastAccessTime.dwLowDateTime=0x2781ec10, ftLastAccessTime.dwHighDateTime=0x1d627dd, ftLastWriteTime.dwLowDateTime=0x89ece3e6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="0GxO-atSGdfuD_nb-.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="0GXO-A~1.MAD")) returned 1 [0077.369] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12cfe740, ftCreationTime.dwHighDateTime=0x1d6276a, ftLastAccessTime.dwLowDateTime=0x769d2ea0, ftLastAccessTime.dwHighDateTime=0x1d62822, ftLastWriteTime.dwLowDateTime=0x89f1a8d3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x17c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="3PHmmYDpfwfx7H.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="3PHMMY~1.MAD")) returned 1 [0077.369] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dbf230, ftCreationTime.dwHighDateTime=0x1d624d8, ftLastAccessTime.dwLowDateTime=0x635c7190, ftLastAccessTime.dwHighDateTime=0x1d62b27, ftLastWriteTime.dwLowDateTime=0x8a0e45f2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16c90, dwReserved0=0x0, dwReserved1=0x0, cFileName="bJhvjZj5PJ9feE3_B.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="BJHVJZ~1.MAD")) returned 1 [0077.369] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28221730, ftCreationTime.dwHighDateTime=0x1d624bd, ftLastAccessTime.dwLowDateTime=0xc2407510, ftLastAccessTime.dwHighDateTime=0x1d624d0, ftLastWriteTime.dwLowDateTime=0x8a17cfae, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1170, dwReserved0=0x0, dwReserved1=0x0, cFileName="bVdG y.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="BVDGYS~1.MAD")) returned 1 [0077.369] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0077.370] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaff14080, ftCreationTime.dwHighDateTime=0x1d62870, ftLastAccessTime.dwLowDateTime=0x604b61d0, ftLastAccessTime.dwHighDateTime=0x1d623a4, ftLastWriteTime.dwLowDateTime=0x8a1c93c4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x30a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F65O.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="F65OFL~1.MAD")) returned 1 [0077.370] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a6fb3f0, ftCreationTime.dwHighDateTime=0x1d62d9a, ftLastAccessTime.dwLowDateTime=0xc01ca400, ftLastAccessTime.dwHighDateTime=0x1d62d7e, ftLastWriteTime.dwLowDateTime=0x8a289329, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hC0AvAmwba.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HC0AVA~1.MAD")) returned 1 [0077.370] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73428170, ftCreationTime.dwHighDateTime=0x1d62c81, ftLastAccessTime.dwLowDateTime=0x3554d6b0, ftLastAccessTime.dwHighDateTime=0x1d622d1, ftLastWriteTime.dwLowDateTime=0x3554d6b0, ftLastWriteTime.dwHighDateTime=0x1d622d1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JQscOqa4VudNzL", cAlternateFileName="JQSCOQ~1")) returned 1 [0077.370] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4646280, ftCreationTime.dwHighDateTime=0x1d624fc, ftLastAccessTime.dwLowDateTime=0x48eeec70, ftLastAccessTime.dwHighDateTime=0x1d62e74, ftLastWriteTime.dwLowDateTime=0x48eeec70, ftLastWriteTime.dwHighDateTime=0x1d62e74, nFileSizeHigh=0x0, nFileSizeLow=0xb7af, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWkdHlKqUxbJlw3.mkv", cAlternateFileName="RWKDHL~1.MKV")) returned 1 [0077.370] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f2ab80, ftCreationTime.dwHighDateTime=0x1d627ff, ftLastAccessTime.dwLowDateTime=0xdd0deb00, ftLastAccessTime.dwHighDateTime=0x1d62f59, ftLastWriteTime.dwLowDateTime=0xdd0deb00, ftLastWriteTime.dwHighDateTime=0x1d62f59, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VrjM2gUeZLzouOH", cAlternateFileName="VRJM2G~1")) returned 1 [0077.370] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57537230, ftCreationTime.dwHighDateTime=0x1d627c7, ftLastAccessTime.dwLowDateTime=0x9f7c2f50, ftLastAccessTime.dwHighDateTime=0x1d6245e, ftLastWriteTime.dwLowDateTime=0x8a2ae1ee, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa940, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xmz5xDFkdqyDo.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="XMZ5XD~1.MAD")) returned 1 [0077.370] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57537230, ftCreationTime.dwHighDateTime=0x1d627c7, ftLastAccessTime.dwLowDateTime=0x9f7c2f50, ftLastAccessTime.dwHighDateTime=0x1d6245e, ftLastWriteTime.dwLowDateTime=0x8a2ae1ee, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa940, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xmz5xDFkdqyDo.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="XMZ5XD~1.MAD")) returned 0 [0077.370] FindClose (in: hFindFile=0xac1308 | out: hFindFile=0xac1308) returned 1 [0077.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0077.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0077.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL", lpFilePart=0x0) returned 0x25 [0077.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0077.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL", lpFilePart=0x0) returned 0x25 [0077.371] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73428170, ftCreationTime.dwHighDateTime=0x1d62c81, ftLastAccessTime.dwLowDateTime=0x3554d6b0, ftLastAccessTime.dwHighDateTime=0x1d622d1, ftLastWriteTime.dwLowDateTime=0x3554d6b0, ftLastWriteTime.dwHighDateTime=0x1d622d1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1308 [0077.371] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73428170, ftCreationTime.dwHighDateTime=0x1d62c81, ftLastAccessTime.dwLowDateTime=0x3554d6b0, ftLastAccessTime.dwHighDateTime=0x1d622d1, ftLastWriteTime.dwLowDateTime=0x3554d6b0, ftLastWriteTime.dwHighDateTime=0x1d622d1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.371] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69da990, ftCreationTime.dwHighDateTime=0x1d6310a, ftLastAccessTime.dwLowDateTime=0xaafff1c0, ftLastAccessTime.dwHighDateTime=0x1d62f14, ftLastWriteTime.dwLowDateTime=0xaafff1c0, ftLastWriteTime.dwHighDateTime=0x1d62f14, nFileSizeHigh=0x0, nFileSizeLow=0xedf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="57u41F2p2nI.avi", cAlternateFileName="57U41F~1.AVI")) returned 1 [0077.371] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99ce70, ftCreationTime.dwHighDateTime=0x1d62a84, ftLastAccessTime.dwLowDateTime=0xdf9e6510, ftLastAccessTime.dwHighDateTime=0x1d62a23, ftLastWriteTime.dwLowDateTime=0xdf9e6510, ftLastWriteTime.dwHighDateTime=0x1d62a23, nFileSizeHigh=0x0, nFileSizeLow=0x15ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUpXL80b2P Puv.flv", cAlternateFileName="MUPXL8~1.FLV")) returned 1 [0077.371] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51a43490, ftCreationTime.dwHighDateTime=0x1d6276e, ftLastAccessTime.dwLowDateTime=0x5c0d26b0, ftLastAccessTime.dwHighDateTime=0x1d62577, ftLastWriteTime.dwLowDateTime=0x5c0d26b0, ftLastWriteTime.dwHighDateTime=0x1d62577, nFileSizeHigh=0x0, nFileSizeLow=0xbab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="qqxv_2b-B8BHXk.flv", cAlternateFileName="QQXV_2~1.FLV")) returned 1 [0077.372] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862712b0, ftCreationTime.dwHighDateTime=0x1d62574, ftLastAccessTime.dwLowDateTime=0x6c1f9760, ftLastAccessTime.dwHighDateTime=0x1d62bab, ftLastWriteTime.dwLowDateTime=0x6c1f9760, ftLastWriteTime.dwHighDateTime=0x1d62bab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY7x", cAlternateFileName="")) returned 1 [0077.372] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb9a4e00, ftCreationTime.dwHighDateTime=0x1d6307c, ftLastAccessTime.dwLowDateTime=0xec4e2700, ftLastAccessTime.dwHighDateTime=0x1d631fd, ftLastWriteTime.dwLowDateTime=0xec4e2700, ftLastWriteTime.dwHighDateTime=0x1d631fd, nFileSizeHigh=0x0, nFileSizeLow=0x26f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="tFugj.avi", cAlternateFileName="")) returned 1 [0077.372] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.372] FindClose (in: hFindFile=0xac1308 | out: hFindFile=0xac1308) returned 1 [0077.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0077.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0077.372] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi", lpFilePart=0x0) returned 0x35 [0077.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0077.372] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\57u41f2p2ni.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.372] GetFileType (hFile=0x2d0) returned 0x1 [0077.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0077.372] GetFileType (hFile=0x2d0) returned 0x1 [0077.372] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xedf4 [0077.372] ReadFile (in: hFile=0x2d0, lpBuffer=0x28adfbc, nNumberOfBytesToRead=0xedf4, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28adfbc*, lpNumberOfBytesRead=0x8fe75c*=0xedf4, lpOverlapped=0x0) returned 1 [0077.373] CloseHandle (hObject=0x2d0) returned 1 [0077.471] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi", lpFilePart=0x0) returned 0x35 [0077.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0077.471] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\57u41f2p2ni.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.472] GetFileType (hFile=0x2d0) returned 0x1 [0077.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0077.472] GetFileType (hFile=0x2d0) returned 0x1 [0077.472] WriteFile (in: hFile=0x2d0, lpBuffer=0x273c75c*, nNumberOfBytesToWrite=0xee00, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x273c75c*, lpNumberOfBytesWritten=0x8fe74c*=0xee00, lpOverlapped=0x0) returned 1 [0077.474] CloseHandle (hObject=0x2d0) returned 1 [0077.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi", lpFilePart=0x0) returned 0x35 [0077.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x60 [0077.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0077.475] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\57u41f2p2ni.avi"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69da990, ftCreationTime.dwHighDateTime=0x1d6310a, ftLastAccessTime.dwLowDateTime=0xaafff1c0, ftLastAccessTime.dwHighDateTime=0x1d62f14, ftLastWriteTime.dwLowDateTime=0x8a3b9133, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xee00)) returned 1 [0077.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0077.476] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\57u41f2p2ni.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\57u41F2p2nI.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\57u41f2p2ni.avi.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv", lpFilePart=0x0) returned 0x38 [0077.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0077.476] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\mupxl80b2p puv.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.477] GetFileType (hFile=0x2d0) returned 0x1 [0077.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0077.477] GetFileType (hFile=0x2d0) returned 0x1 [0077.477] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x15ffa [0077.477] ReadFile (in: hFile=0x2d0, lpBuffer=0x3942ce8, nNumberOfBytesToRead=0x15ffa, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x3942ce8*, lpNumberOfBytesRead=0x8fe75c*=0x15ffa, lpOverlapped=0x0) returned 1 [0077.477] CloseHandle (hObject=0x2d0) returned 1 [0077.590] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv", lpFilePart=0x0) returned 0x38 [0077.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0077.590] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\mupxl80b2p puv.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.591] GetFileType (hFile=0x2d0) returned 0x1 [0077.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0077.591] GetFileType (hFile=0x2d0) returned 0x1 [0077.591] WriteFile (in: hFile=0x2d0, lpBuffer=0x39cb4b0*, nNumberOfBytesToWrite=0x16000, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x39cb4b0*, lpNumberOfBytesWritten=0x8fe74c*=0x16000, lpOverlapped=0x0) returned 1 [0077.592] CloseHandle (hObject=0x2d0) returned 1 [0077.594] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv", lpFilePart=0x0) returned 0x38 [0077.594] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x63 [0077.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0077.594] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\mupxl80b2p puv.flv"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99ce70, ftCreationTime.dwHighDateTime=0x1d62a84, ftLastAccessTime.dwLowDateTime=0xdf9e6510, ftLastAccessTime.dwHighDateTime=0x1d62a23, ftLastWriteTime.dwLowDateTime=0x8a4c42b3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16000)) returned 1 [0077.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0077.595] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\mupxl80b2p puv.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\MUpXL80b2P Puv.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\mupxl80b2p puv.flv.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.596] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv", lpFilePart=0x0) returned 0x38 [0077.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0077.596] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\qqxv_2b-b8bhxk.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.596] GetFileType (hFile=0x2d0) returned 0x1 [0077.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0077.596] GetFileType (hFile=0x2d0) returned 0x1 [0077.596] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xbab8 [0077.596] ReadFile (in: hFile=0x2d0, lpBuffer=0x2798dfc, nNumberOfBytesToRead=0xbab8, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2798dfc*, lpNumberOfBytesRead=0x8fe75c*=0xbab8, lpOverlapped=0x0) returned 1 [0077.596] CloseHandle (hObject=0x2d0) returned 1 [0077.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv", lpFilePart=0x0) returned 0x38 [0077.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0077.665] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\qqxv_2b-b8bhxk.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.666] GetFileType (hFile=0x2d0) returned 0x1 [0077.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0077.666] GetFileType (hFile=0x2d0) returned 0x1 [0077.666] WriteFile (in: hFile=0x2d0, lpBuffer=0x2808c50*, nNumberOfBytesToWrite=0xbac0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2808c50*, lpNumberOfBytesWritten=0x8fe74c*=0xbac0, lpOverlapped=0x0) returned 1 [0077.667] CloseHandle (hObject=0x2d0) returned 1 [0077.669] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv", lpFilePart=0x0) returned 0x38 [0077.669] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x63 [0077.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0077.669] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\qqxv_2b-b8bhxk.flv"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51a43490, ftCreationTime.dwHighDateTime=0x1d6276e, ftLastAccessTime.dwLowDateTime=0x5c0d26b0, ftLastAccessTime.dwHighDateTime=0x1d62577, ftLastWriteTime.dwLowDateTime=0x8a582e70, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xbac0)) returned 1 [0077.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0077.669] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\qqxv_2b-b8bhxk.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\qqxv_2b-B8BHXk.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\qqxv_2b-b8bhxk.flv.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.669] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi", lpFilePart=0x0) returned 0x2f [0077.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0077.670] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\tfugj.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.670] GetFileType (hFile=0x2d0) returned 0x1 [0077.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0077.670] GetFileType (hFile=0x2d0) returned 0x1 [0077.670] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x26f2 [0077.670] ReadFile (in: hFile=0x2d0, lpBuffer=0x2814b94, nNumberOfBytesToRead=0x26f2, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2814b94*, lpNumberOfBytesRead=0x8fe75c*=0x26f2, lpOverlapped=0x0) returned 1 [0077.670] CloseHandle (hObject=0x2d0) returned 1 [0077.686] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi", lpFilePart=0x0) returned 0x2f [0077.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0077.686] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\tfugj.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.686] GetFileType (hFile=0x2d0) returned 0x1 [0077.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0077.686] GetFileType (hFile=0x2d0) returned 0x1 [0077.686] WriteFile (in: hFile=0x2d0, lpBuffer=0x286dc98*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x286dc98*, lpNumberOfBytesWritten=0x8fe74c*=0x2700, lpOverlapped=0x0) returned 1 [0077.687] CloseHandle (hObject=0x2d0) returned 1 [0077.688] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi", lpFilePart=0x0) returned 0x2f [0077.688] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5a [0077.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0077.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\tfugj.avi"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb9a4e00, ftCreationTime.dwHighDateTime=0x1d6307c, ftLastAccessTime.dwLowDateTime=0xec4e2700, ftLastAccessTime.dwHighDateTime=0x1d631fd, ftLastWriteTime.dwLowDateTime=0x8a5a917e, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2700)) returned 1 [0077.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0077.689] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\tfugj.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\tFugj.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\tfugj.avi.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0077.689] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL", lpFilePart=0x0) returned 0x25 [0077.689] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73428170, ftCreationTime.dwHighDateTime=0x1d62c81, ftLastAccessTime.dwLowDateTime=0x8a5cf30d, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8a5cf30d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1408 [0077.690] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73428170, ftCreationTime.dwHighDateTime=0x1d62c81, ftLastAccessTime.dwLowDateTime=0x8a5cf30d, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8a5cf30d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.690] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf69da990, ftCreationTime.dwHighDateTime=0x1d6310a, ftLastAccessTime.dwLowDateTime=0xaafff1c0, ftLastAccessTime.dwHighDateTime=0x1d62f14, ftLastWriteTime.dwLowDateTime=0x8a3b9133, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xee00, dwReserved0=0x0, dwReserved1=0x0, cFileName="57u41F2p2nI.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="57U41F~1.MAD")) returned 1 [0077.690] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99ce70, ftCreationTime.dwHighDateTime=0x1d62a84, ftLastAccessTime.dwLowDateTime=0xdf9e6510, ftLastAccessTime.dwHighDateTime=0x1d62a23, ftLastWriteTime.dwLowDateTime=0x8a4c42b3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUpXL80b2P Puv.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="MUPXL8~1.MAD")) returned 1 [0077.690] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51a43490, ftCreationTime.dwHighDateTime=0x1d6276e, ftLastAccessTime.dwLowDateTime=0x5c0d26b0, ftLastAccessTime.dwHighDateTime=0x1d62577, ftLastWriteTime.dwLowDateTime=0x8a582e70, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xbac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qqxv_2b-B8BHXk.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="QQXV_2~1.MAD")) returned 1 [0077.690] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862712b0, ftCreationTime.dwHighDateTime=0x1d62574, ftLastAccessTime.dwLowDateTime=0x6c1f9760, ftLastAccessTime.dwHighDateTime=0x1d62bab, ftLastWriteTime.dwLowDateTime=0x6c1f9760, ftLastWriteTime.dwHighDateTime=0x1d62bab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY7x", cAlternateFileName="")) returned 1 [0077.690] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb9a4e00, ftCreationTime.dwHighDateTime=0x1d6307c, ftLastAccessTime.dwLowDateTime=0xec4e2700, ftLastAccessTime.dwHighDateTime=0x1d631fd, ftLastWriteTime.dwLowDateTime=0x8a5a917e, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="tFugj.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="TFUGJA~1.MAD")) returned 1 [0077.690] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb9a4e00, ftCreationTime.dwHighDateTime=0x1d6307c, ftLastAccessTime.dwLowDateTime=0xec4e2700, ftLastAccessTime.dwHighDateTime=0x1d631fd, ftLastWriteTime.dwLowDateTime=0x8a5a917e, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="tFugj.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="TFUGJA~1.MAD")) returned 0 [0077.690] FindClose (in: hFindFile=0xac1408 | out: hFindFile=0xac1408) returned 1 [0077.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0077.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0077.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x", nBufferLength=0x105, lpBuffer=0x8fe250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x", lpFilePart=0x0) returned 0x2a [0077.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0077.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x", lpFilePart=0x0) returned 0x2a [0077.691] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862712b0, ftCreationTime.dwHighDateTime=0x1d62574, ftLastAccessTime.dwLowDateTime=0x6c1f9760, ftLastAccessTime.dwHighDateTime=0x1d62bab, ftLastWriteTime.dwLowDateTime=0x6c1f9760, ftLastWriteTime.dwHighDateTime=0x1d62bab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0077.691] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862712b0, ftCreationTime.dwHighDateTime=0x1d62574, ftLastAccessTime.dwLowDateTime=0x6c1f9760, ftLastAccessTime.dwHighDateTime=0x1d62bab, ftLastWriteTime.dwLowDateTime=0x6c1f9760, ftLastWriteTime.dwHighDateTime=0x1d62bab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.691] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4cd2b60, ftCreationTime.dwHighDateTime=0x1d62ffd, ftLastAccessTime.dwLowDateTime=0x28725dc0, ftLastAccessTime.dwHighDateTime=0x1d625f4, ftLastWriteTime.dwLowDateTime=0x28725dc0, ftLastWriteTime.dwHighDateTime=0x1d625f4, nFileSizeHigh=0x0, nFileSizeLow=0x6c32, dwReserved0=0x0, dwReserved1=0x0, cFileName="5JJM.swf", cAlternateFileName="")) returned 1 [0077.691] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c755f0, ftCreationTime.dwHighDateTime=0x1d62603, ftLastAccessTime.dwLowDateTime=0x62c968c0, ftLastAccessTime.dwHighDateTime=0x1d622b5, ftLastWriteTime.dwLowDateTime=0x62c968c0, ftLastWriteTime.dwHighDateTime=0x1d622b5, nFileSizeHigh=0x0, nFileSizeLow=0x121ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="hub1GIyio0k3IC2W-kn.swf", cAlternateFileName="HUB1GI~1.SWF")) returned 1 [0077.691] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4fb2fb0, ftCreationTime.dwHighDateTime=0x1d63017, ftLastAccessTime.dwLowDateTime=0x8f5201c0, ftLastAccessTime.dwHighDateTime=0x1d6264a, ftLastWriteTime.dwLowDateTime=0x8f5201c0, ftLastWriteTime.dwHighDateTime=0x1d6264a, nFileSizeHigh=0x0, nFileSizeLow=0xdd30, dwReserved0=0x0, dwReserved1=0x0, cFileName="M3JHdg.swf", cAlternateFileName="")) returned 1 [0077.691] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22d1010, ftCreationTime.dwHighDateTime=0x1d62f5d, ftLastAccessTime.dwLowDateTime=0xb8131b0, ftLastAccessTime.dwHighDateTime=0x1d6325a, ftLastWriteTime.dwLowDateTime=0xb8131b0, ftLastWriteTime.dwHighDateTime=0x1d6325a, nFileSizeHigh=0x0, nFileSizeLow=0x11fd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PEFXazhPvaHB2qOHSL.mkv", cAlternateFileName="PEFXAZ~1.MKV")) returned 1 [0077.691] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369c3700, ftCreationTime.dwHighDateTime=0x1d623d2, ftLastAccessTime.dwLowDateTime=0x3896add0, ftLastAccessTime.dwHighDateTime=0x1d6300f, ftLastWriteTime.dwLowDateTime=0x3896add0, ftLastWriteTime.dwHighDateTime=0x1d6300f, nFileSizeHigh=0x0, nFileSizeLow=0x9349, dwReserved0=0x0, dwReserved1=0x0, cFileName="pzIA8kdTmEYo4YQYrNO.flv", cAlternateFileName="PZIA8K~1.FLV")) returned 1 [0077.692] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a6f53f0, ftCreationTime.dwHighDateTime=0x1d62fe5, ftLastAccessTime.dwLowDateTime=0xb6db1de0, ftLastAccessTime.dwHighDateTime=0x1d62f54, ftLastWriteTime.dwLowDateTime=0xb6db1de0, ftLastWriteTime.dwHighDateTime=0x1d62f54, nFileSizeHigh=0x0, nFileSizeLow=0x5fd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="thlxR6cPpFPYIm.flv", cAlternateFileName="THLXR6~1.FLV")) returned 1 [0077.692] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.692] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0077.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0077.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0077.692] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf", lpFilePart=0x0) returned 0x33 [0077.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0077.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\5jjm.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.692] GetFileType (hFile=0x2d0) returned 0x1 [0077.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0077.692] GetFileType (hFile=0x2d0) returned 0x1 [0077.692] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x6c32 [0077.692] ReadFile (in: hFile=0x2d0, lpBuffer=0x2872d8c, nNumberOfBytesToRead=0x6c32, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x2872d8c*, lpNumberOfBytesRead=0x8fe718*=0x6c32, lpOverlapped=0x0) returned 1 [0077.692] CloseHandle (hObject=0x2d0) returned 1 [0077.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf", lpFilePart=0x0) returned 0x33 [0077.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0077.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\5jjm.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.762] GetFileType (hFile=0x2d0) returned 0x1 [0077.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0077.762] GetFileType (hFile=0x2d0) returned 0x1 [0077.762] WriteFile (in: hFile=0x2d0, lpBuffer=0x28e18d0*, nNumberOfBytesToWrite=0x6c40, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x28e18d0*, lpNumberOfBytesWritten=0x8fe708*=0x6c40, lpOverlapped=0x0) returned 1 [0077.763] CloseHandle (hObject=0x2d0) returned 1 [0077.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf", lpFilePart=0x0) returned 0x33 [0077.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5e [0077.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0077.764] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\5jjm.swf"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4cd2b60, ftCreationTime.dwHighDateTime=0x1d62ffd, ftLastAccessTime.dwLowDateTime=0x28725dc0, ftLastAccessTime.dwHighDateTime=0x1d625f4, ftLastWriteTime.dwLowDateTime=0x8a667ddb, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x6c40)) returned 1 [0077.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0077.764] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\5jjm.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\5JJM.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\5jjm.swf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.765] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf", lpFilePart=0x0) returned 0x42 [0077.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0077.765] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\hub1giyio0k3ic2w-kn.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.765] GetFileType (hFile=0x2d0) returned 0x1 [0077.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0077.765] GetFileType (hFile=0x2d0) returned 0x1 [0077.765] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x121ab [0077.765] ReadFile (in: hFile=0x2d0, lpBuffer=0x28e899c, nNumberOfBytesToRead=0x121ab, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x28e899c*, lpNumberOfBytesRead=0x8fe718*=0x121ab, lpOverlapped=0x0) returned 1 [0077.765] CloseHandle (hObject=0x2d0) returned 1 [0077.832] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf", lpFilePart=0x0) returned 0x42 [0077.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0077.832] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\hub1giyio0k3ic2w-kn.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.833] GetFileType (hFile=0x2d0) returned 0x1 [0077.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0077.833] GetFileType (hFile=0x2d0) returned 0x1 [0077.833] WriteFile (in: hFile=0x2d0, lpBuffer=0x2722de8*, nNumberOfBytesToWrite=0x121b0, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x2722de8*, lpNumberOfBytesWritten=0x8fe708*=0x121b0, lpOverlapped=0x0) returned 1 [0077.834] CloseHandle (hObject=0x2d0) returned 1 [0077.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf", lpFilePart=0x0) returned 0x42 [0077.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6d [0077.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0077.836] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\hub1giyio0k3ic2w-kn.swf"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c755f0, ftCreationTime.dwHighDateTime=0x1d62603, ftLastAccessTime.dwLowDateTime=0x62c968c0, ftLastAccessTime.dwHighDateTime=0x1d622b5, ftLastWriteTime.dwLowDateTime=0x8a726956, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x121b0)) returned 1 [0077.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0077.836] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\hub1giyio0k3ic2w-kn.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\hub1GIyio0k3IC2W-kn.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\hub1giyio0k3ic2w-kn.swf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.837] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf", lpFilePart=0x0) returned 0x35 [0077.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0077.837] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\m3jhdg.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.837] GetFileType (hFile=0x2d0) returned 0x1 [0077.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0077.837] GetFileType (hFile=0x2d0) returned 0x1 [0077.837] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0xdd30 [0077.837] ReadFile (in: hFile=0x2d0, lpBuffer=0x2735484, nNumberOfBytesToRead=0xdd30, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x2735484*, lpNumberOfBytesRead=0x8fe718*=0xdd30, lpOverlapped=0x0) returned 1 [0077.838] CloseHandle (hObject=0x2d0) returned 1 [0077.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf", lpFilePart=0x0) returned 0x35 [0077.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0077.875] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\m3jhdg.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.901] GetFileType (hFile=0x2d0) returned 0x1 [0077.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0077.902] GetFileType (hFile=0x2d0) returned 0x1 [0077.902] WriteFile (in: hFile=0x2d0, lpBuffer=0x27abbb4*, nNumberOfBytesToWrite=0xdd40, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x27abbb4*, lpNumberOfBytesWritten=0x8fe708*=0xdd40, lpOverlapped=0x0) returned 1 [0077.903] CloseHandle (hObject=0x2d0) returned 1 [0077.904] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf", lpFilePart=0x0) returned 0x35 [0077.904] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x60 [0077.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0077.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\m3jhdg.swf"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4fb2fb0, ftCreationTime.dwHighDateTime=0x1d63017, ftLastAccessTime.dwLowDateTime=0x8f5201c0, ftLastAccessTime.dwHighDateTime=0x1d6264a, ftLastWriteTime.dwLowDateTime=0x8a7bf2d1, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xdd40)) returned 1 [0077.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0077.905] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\m3jhdg.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\M3JHdg.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\m3jhdg.swf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.905] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv", lpFilePart=0x0) returned 0x42 [0077.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0077.905] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\pzia8kdtmeyo4yqyrno.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.905] GetFileType (hFile=0x2d0) returned 0x1 [0077.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0077.906] GetFileType (hFile=0x2d0) returned 0x1 [0077.906] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x9349 [0077.906] ReadFile (in: hFile=0x2d0, lpBuffer=0x27b9dac, nNumberOfBytesToRead=0x9349, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x27b9dac*, lpNumberOfBytesRead=0x8fe718*=0x9349, lpOverlapped=0x0) returned 1 [0077.906] CloseHandle (hObject=0x2d0) returned 1 [0077.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv", lpFilePart=0x0) returned 0x42 [0077.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0077.923] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\pzia8kdtmeyo4yqyrno.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.924] GetFileType (hFile=0x2d0) returned 0x1 [0077.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0077.924] GetFileType (hFile=0x2d0) returned 0x1 [0077.924] WriteFile (in: hFile=0x2d0, lpBuffer=0x2834c40*, nNumberOfBytesToWrite=0x9350, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x2834c40*, lpNumberOfBytesWritten=0x8fe708*=0x9350, lpOverlapped=0x0) returned 1 [0077.925] CloseHandle (hObject=0x2d0) returned 1 [0077.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv", lpFilePart=0x0) returned 0x42 [0077.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6d [0077.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0077.927] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\pzia8kdtmeyo4yqyrno.flv"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369c3700, ftCreationTime.dwHighDateTime=0x1d623d2, ftLastAccessTime.dwLowDateTime=0x3896add0, ftLastAccessTime.dwHighDateTime=0x1d6300f, ftLastWriteTime.dwLowDateTime=0x8a80b666, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9350)) returned 1 [0077.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0077.927] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\pzia8kdtmeyo4yqyrno.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\pzIA8kdTmEYo4YQYrNO.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\pzia8kdtmeyo4yqyrno.flv.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv", lpFilePart=0x0) returned 0x3d [0077.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0077.928] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\thlxr6cppfpyim.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.928] GetFileType (hFile=0x2d0) returned 0x1 [0077.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0077.928] GetFileType (hFile=0x2d0) returned 0x1 [0077.928] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x5fd5 [0077.928] ReadFile (in: hFile=0x2d0, lpBuffer=0x283e49c, nNumberOfBytesToRead=0x5fd5, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x283e49c*, lpNumberOfBytesRead=0x8fe718*=0x5fd5, lpOverlapped=0x0) returned 1 [0077.928] CloseHandle (hObject=0x2d0) returned 1 [0077.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv", lpFilePart=0x0) returned 0x3d [0077.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0077.991] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\thlxr6cppfpyim.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0077.992] GetFileType (hFile=0x2d0) returned 0x1 [0077.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0077.992] GetFileType (hFile=0x2d0) returned 0x1 [0077.992] WriteFile (in: hFile=0x2d0, lpBuffer=0x28a9200*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x28a9200*, lpNumberOfBytesWritten=0x8fe708*=0x5fe0, lpOverlapped=0x0) returned 1 [0077.995] CloseHandle (hObject=0x2d0) returned 1 [0077.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv", lpFilePart=0x0) returned 0x3d [0077.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x68 [0077.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0077.996] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\thlxr6cppfpyim.flv"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a6f53f0, ftCreationTime.dwHighDateTime=0x1d62fe5, ftLastAccessTime.dwLowDateTime=0xb6db1de0, ftLastAccessTime.dwHighDateTime=0x1d62f54, ftLastWriteTime.dwLowDateTime=0x8a8a3ea3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5fe0)) returned 1 [0077.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0077.996] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\thlxr6cppfpyim.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\thlxR6cPpFPYIm.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\jqscoqa4vudnzl\\sy7x\\thlxr6cppfpyim.flv.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0077.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0077.997] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x", lpFilePart=0x0) returned 0x2a [0077.997] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\JQscOqa4VudNzL\\SY7x\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862712b0, ftCreationTime.dwHighDateTime=0x1d62574, ftLastAccessTime.dwLowDateTime=0x8a8a3ea3, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8a8a3ea3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1188 [0077.997] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x862712b0, ftCreationTime.dwHighDateTime=0x1d62574, ftLastAccessTime.dwLowDateTime=0x8a8a3ea3, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8a8a3ea3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.997] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4cd2b60, ftCreationTime.dwHighDateTime=0x1d62ffd, ftLastAccessTime.dwLowDateTime=0x28725dc0, ftLastAccessTime.dwHighDateTime=0x1d625f4, ftLastWriteTime.dwLowDateTime=0x8a667ddb, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x6c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="5JJM.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="5JJMSW~1.MAD")) returned 1 [0077.997] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c755f0, ftCreationTime.dwHighDateTime=0x1d62603, ftLastAccessTime.dwLowDateTime=0x62c968c0, ftLastAccessTime.dwHighDateTime=0x1d622b5, ftLastWriteTime.dwLowDateTime=0x8a726956, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x121b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hub1GIyio0k3IC2W-kn.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HUB1GI~1.MAD")) returned 1 [0077.997] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4fb2fb0, ftCreationTime.dwHighDateTime=0x1d63017, ftLastAccessTime.dwLowDateTime=0x8f5201c0, ftLastAccessTime.dwHighDateTime=0x1d6264a, ftLastWriteTime.dwLowDateTime=0x8a7bf2d1, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xdd40, dwReserved0=0x0, dwReserved1=0x0, cFileName="M3JHdg.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="M3JHDG~1.MAD")) returned 1 [0077.997] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22d1010, ftCreationTime.dwHighDateTime=0x1d62f5d, ftLastAccessTime.dwLowDateTime=0xb8131b0, ftLastAccessTime.dwHighDateTime=0x1d6325a, ftLastWriteTime.dwLowDateTime=0xb8131b0, ftLastWriteTime.dwHighDateTime=0x1d6325a, nFileSizeHigh=0x0, nFileSizeLow=0x11fd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PEFXazhPvaHB2qOHSL.mkv", cAlternateFileName="PEFXAZ~1.MKV")) returned 1 [0077.998] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369c3700, ftCreationTime.dwHighDateTime=0x1d623d2, ftLastAccessTime.dwLowDateTime=0x3896add0, ftLastAccessTime.dwHighDateTime=0x1d6300f, ftLastWriteTime.dwLowDateTime=0x8a80b666, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9350, dwReserved0=0x0, dwReserved1=0x0, cFileName="pzIA8kdTmEYo4YQYrNO.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="PZIA8K~1.MAD")) returned 1 [0077.998] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a6f53f0, ftCreationTime.dwHighDateTime=0x1d62fe5, ftLastAccessTime.dwLowDateTime=0xb6db1de0, ftLastAccessTime.dwHighDateTime=0x1d62f54, ftLastWriteTime.dwLowDateTime=0x8a8a3ea3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5fe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="thlxR6cPpFPYIm.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="THLXR6~1.MAD")) returned 1 [0077.998] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a6f53f0, ftCreationTime.dwHighDateTime=0x1d62fe5, ftLastAccessTime.dwLowDateTime=0xb6db1de0, ftLastAccessTime.dwHighDateTime=0x1d62f54, ftLastWriteTime.dwLowDateTime=0x8a8a3ea3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5fe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="thlxR6cPpFPYIm.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="THLXR6~1.MAD")) returned 0 [0077.998] FindClose (in: hFindFile=0xac1188 | out: hFindFile=0xac1188) returned 1 [0077.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0077.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0077.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH", lpFilePart=0x0) returned 0x26 [0077.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0077.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH", lpFilePart=0x0) returned 0x26 [0077.998] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f2ab80, ftCreationTime.dwHighDateTime=0x1d627ff, ftLastAccessTime.dwLowDateTime=0xdd0deb00, ftLastAccessTime.dwHighDateTime=0x1d62f59, ftLastWriteTime.dwLowDateTime=0xdd0deb00, ftLastWriteTime.dwHighDateTime=0x1d62f59, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1288 [0077.998] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f2ab80, ftCreationTime.dwHighDateTime=0x1d627ff, ftLastAccessTime.dwLowDateTime=0xdd0deb00, ftLastAccessTime.dwHighDateTime=0x1d62f59, ftLastWriteTime.dwLowDateTime=0xdd0deb00, ftLastWriteTime.dwHighDateTime=0x1d62f59, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.998] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd18780, ftCreationTime.dwHighDateTime=0x1d625f0, ftLastAccessTime.dwLowDateTime=0xa5027680, ftLastAccessTime.dwHighDateTime=0x1d62dde, ftLastWriteTime.dwLowDateTime=0xa5027680, ftLastWriteTime.dwHighDateTime=0x1d62dde, nFileSizeHigh=0x0, nFileSizeLow=0xa08b, dwReserved0=0x0, dwReserved1=0x0, cFileName="-AyXsbLXi4y2WQ2cPlg.swf", cAlternateFileName="-AYXSB~1.SWF")) returned 1 [0077.999] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x639b9b70, ftCreationTime.dwHighDateTime=0x1d623ea, ftLastAccessTime.dwLowDateTime=0xfdaf9ec0, ftLastAccessTime.dwHighDateTime=0x1d6251e, ftLastWriteTime.dwLowDateTime=0xfdaf9ec0, ftLastWriteTime.dwHighDateTime=0x1d6251e, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x0, cFileName="-CT6Zdjo20Jv.mp4", cAlternateFileName="-CT6ZD~1.MP4")) returned 1 [0077.999] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97587210, ftCreationTime.dwHighDateTime=0x1d62ff4, ftLastAccessTime.dwLowDateTime=0xd715dca0, ftLastAccessTime.dwHighDateTime=0x1d62c23, ftLastWriteTime.dwLowDateTime=0xd715dca0, ftLastWriteTime.dwHighDateTime=0x1d62c23, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hE 46Qf3w3ad94", cAlternateFileName="HE46QF~1")) returned 1 [0077.999] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60d254d0, ftCreationTime.dwHighDateTime=0x1d62604, ftLastAccessTime.dwLowDateTime=0x74656030, ftLastAccessTime.dwHighDateTime=0x1d630ab, ftLastWriteTime.dwLowDateTime=0x74656030, ftLastWriteTime.dwHighDateTime=0x1d630ab, nFileSizeHigh=0x0, nFileSizeLow=0x3918, dwReserved0=0x0, dwReserved1=0x0, cFileName="iCFea5v.mkv", cAlternateFileName="")) returned 1 [0077.999] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x299e5360, ftCreationTime.dwHighDateTime=0x1d626e0, ftLastAccessTime.dwLowDateTime=0x1bec7420, ftLastAccessTime.dwHighDateTime=0x1d627a0, ftLastWriteTime.dwLowDateTime=0x1bec7420, ftLastWriteTime.dwHighDateTime=0x1d627a0, nFileSizeHigh=0x0, nFileSizeLow=0xd219, dwReserved0=0x0, dwReserved1=0x0, cFileName="N4usFdd_QP3Q50uG.swf", cAlternateFileName="N4USFD~1.SWF")) returned 1 [0077.999] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9fa210, ftCreationTime.dwHighDateTime=0x1d623fa, ftLastAccessTime.dwLowDateTime=0x338d01a0, ftLastAccessTime.dwHighDateTime=0x1d631bc, ftLastWriteTime.dwLowDateTime=0x338d01a0, ftLastWriteTime.dwHighDateTime=0x1d631bc, nFileSizeHigh=0x0, nFileSizeLow=0x10db9, dwReserved0=0x0, dwReserved1=0x0, cFileName="oXXecVesFjY.avi", cAlternateFileName="OXXECV~1.AVI")) returned 1 [0077.999] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8991d370, ftCreationTime.dwHighDateTime=0x1d6255d, ftLastAccessTime.dwLowDateTime=0xc1f19ca0, ftLastAccessTime.dwHighDateTime=0x1d62ac1, ftLastWriteTime.dwLowDateTime=0xc1f19ca0, ftLastWriteTime.dwHighDateTime=0x1d62ac1, nFileSizeHigh=0x0, nFileSizeLow=0x5da7, dwReserved0=0x0, dwReserved1=0x0, cFileName="pKl09b9N4K64qD-AyvVX.swf", cAlternateFileName="PKL09B~1.SWF")) returned 1 [0077.999] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcca6900, ftCreationTime.dwHighDateTime=0x1d631e2, ftLastAccessTime.dwLowDateTime=0x72ed6050, ftLastAccessTime.dwHighDateTime=0x1d631d6, ftLastWriteTime.dwLowDateTime=0x72ed6050, ftLastWriteTime.dwHighDateTime=0x1d631d6, nFileSizeHigh=0x0, nFileSizeLow=0x10d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZfbP7IlCLQZN.flv", cAlternateFileName="ZFBP7I~1.FLV")) returned 1 [0077.999] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.999] FindClose (in: hFindFile=0xac1288 | out: hFindFile=0xac1288) returned 1 [0077.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0077.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0078.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf", lpFilePart=0x0) returned 0x3e [0078.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0078.000] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\-ayxsblxi4y2wq2cplg.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.000] GetFileType (hFile=0x2d0) returned 0x1 [0078.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0078.000] GetFileType (hFile=0x2d0) returned 0x1 [0078.000] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xa08b [0078.000] ReadFile (in: hFile=0x2d0, lpBuffer=0x28b2294, nNumberOfBytesToRead=0xa08b, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28b2294*, lpNumberOfBytesRead=0x8fe75c*=0xa08b, lpOverlapped=0x0) returned 1 [0078.000] CloseHandle (hObject=0x2d0) returned 1 [0078.019] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf", lpFilePart=0x0) returned 0x3e [0078.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0078.019] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\-ayxsblxi4y2wq2cplg.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.020] GetFileType (hFile=0x2d0) returned 0x1 [0078.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0078.020] GetFileType (hFile=0x2d0) returned 0x1 [0078.020] WriteFile (in: hFile=0x2d0, lpBuffer=0x2931368*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2931368*, lpNumberOfBytesWritten=0x8fe74c*=0xa090, lpOverlapped=0x0) returned 1 [0078.021] CloseHandle (hObject=0x2d0) returned 1 [0078.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf", lpFilePart=0x0) returned 0x3e [0078.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x69 [0078.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0078.022] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\-ayxsblxi4y2wq2cplg.swf"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd18780, ftCreationTime.dwHighDateTime=0x1d625f0, ftLastAccessTime.dwLowDateTime=0xa5027680, ftLastAccessTime.dwHighDateTime=0x1d62dde, ftLastWriteTime.dwLowDateTime=0x8a8f044d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa090)) returned 1 [0078.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0078.022] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\-ayxsblxi4y2wq2cplg.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-AyXsbLXi4y2WQ2cPlg.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\-ayxsblxi4y2wq2cplg.swf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0078.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4", lpFilePart=0x0) returned 0x37 [0078.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0078.023] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\-ct6zdjo20jv.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.023] GetFileType (hFile=0x2d0) returned 0x1 [0078.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0078.023] GetFileType (hFile=0x2d0) returned 0x1 [0078.023] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x17304 [0078.024] ReadFile (in: hFile=0x2d0, lpBuffer=0x37096c8, nNumberOfBytesToRead=0x17304, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x37096c8*, lpNumberOfBytesRead=0x8fe75c*=0x17304, lpOverlapped=0x0) returned 1 [0078.025] CloseHandle (hObject=0x2d0) returned 1 [0078.146] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4", lpFilePart=0x0) returned 0x37 [0078.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0078.146] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\-ct6zdjo20jv.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.147] GetFileType (hFile=0x2d0) returned 0x1 [0078.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0078.147] GetFileType (hFile=0x2d0) returned 0x1 [0078.147] WriteFile (in: hFile=0x2d0, lpBuffer=0x377d648*, nNumberOfBytesToWrite=0x17310, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x377d648*, lpNumberOfBytesWritten=0x8fe74c*=0x17310, lpOverlapped=0x0) returned 1 [0078.149] CloseHandle (hObject=0x2d0) returned 1 [0078.151] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4", lpFilePart=0x0) returned 0x37 [0078.151] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x62 [0078.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0078.151] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\-ct6zdjo20jv.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x639b9b70, ftCreationTime.dwHighDateTime=0x1d623ea, ftLastAccessTime.dwLowDateTime=0xfdaf9ec0, ftLastAccessTime.dwHighDateTime=0x1d6251e, ftLastWriteTime.dwLowDateTime=0x8aa21841, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x17310)) returned 1 [0078.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0078.151] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\-ct6zdjo20jv.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\-CT6Zdjo20Jv.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\-ct6zdjo20jv.mp4.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0078.152] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf", lpFilePart=0x0) returned 0x3b [0078.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0078.152] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\n4usfdd_qp3q50ug.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.152] GetFileType (hFile=0x2d0) returned 0x1 [0078.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0078.152] GetFileType (hFile=0x2d0) returned 0x1 [0078.152] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xd219 [0078.153] ReadFile (in: hFile=0x2d0, lpBuffer=0x2988ba4, nNumberOfBytesToRead=0xd219, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2988ba4*, lpNumberOfBytesRead=0x8fe75c*=0xd219, lpOverlapped=0x0) returned 1 [0078.154] CloseHandle (hObject=0x2d0) returned 1 [0078.226] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf", lpFilePart=0x0) returned 0x3b [0078.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0078.226] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\n4usfdd_qp3q50ug.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.227] GetFileType (hFile=0x2d0) returned 0x1 [0078.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0078.227] GetFileType (hFile=0x2d0) returned 0x1 [0078.227] WriteFile (in: hFile=0x2d0, lpBuffer=0x2738f28*, nNumberOfBytesToWrite=0xd220, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2738f28*, lpNumberOfBytesWritten=0x8fe74c*=0xd220, lpOverlapped=0x0) returned 1 [0078.228] CloseHandle (hObject=0x2d0) returned 1 [0078.230] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf", lpFilePart=0x0) returned 0x3b [0078.230] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x66 [0078.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0078.230] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\n4usfdd_qp3q50ug.swf"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x299e5360, ftCreationTime.dwHighDateTime=0x1d626e0, ftLastAccessTime.dwLowDateTime=0x1bec7420, ftLastAccessTime.dwHighDateTime=0x1d627a0, ftLastWriteTime.dwLowDateTime=0x8aae01ad, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd220)) returned 1 [0078.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0078.231] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\n4usfdd_qp3q50ug.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\N4usFdd_QP3Q50uG.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\n4usfdd_qp3q50ug.swf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0078.231] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi", lpFilePart=0x0) returned 0x36 [0078.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0078.231] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\oxxecvesfjy.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.231] GetFileType (hFile=0x2d0) returned 0x1 [0078.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0078.231] GetFileType (hFile=0x2d0) returned 0x1 [0078.231] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x10db9 [0078.232] ReadFile (in: hFile=0x2d0, lpBuffer=0x2746604, nNumberOfBytesToRead=0x10db9, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2746604*, lpNumberOfBytesRead=0x8fe75c*=0x10db9, lpOverlapped=0x0) returned 1 [0078.232] CloseHandle (hObject=0x2d0) returned 1 [0078.321] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi", lpFilePart=0x0) returned 0x36 [0078.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0078.321] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\oxxecvesfjy.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.322] GetFileType (hFile=0x2d0) returned 0x1 [0078.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0078.322] GetFileType (hFile=0x2d0) returned 0x1 [0078.322] WriteFile (in: hFile=0x2d0, lpBuffer=0x27c5eb8*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27c5eb8*, lpNumberOfBytesWritten=0x8fe74c*=0x10dc0, lpOverlapped=0x0) returned 1 [0078.324] CloseHandle (hObject=0x2d0) returned 1 [0078.325] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi", lpFilePart=0x0) returned 0x36 [0078.325] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x61 [0078.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0078.325] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\oxxecvesfjy.avi"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9fa210, ftCreationTime.dwHighDateTime=0x1d623fa, ftLastAccessTime.dwLowDateTime=0x338d01a0, ftLastAccessTime.dwHighDateTime=0x1d631bc, ftLastWriteTime.dwLowDateTime=0x8abc50ba, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10dc0)) returned 1 [0078.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0078.326] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\oxxecvesfjy.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\oXXecVesFjY.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\oxxecvesfjy.avi.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0078.326] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf", lpFilePart=0x0) returned 0x3f [0078.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0078.326] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\pkl09b9n4k64qd-ayvvx.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.326] GetFileType (hFile=0x2d0) returned 0x1 [0078.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0078.327] GetFileType (hFile=0x2d0) returned 0x1 [0078.327] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x5da7 [0078.327] ReadFile (in: hFile=0x2d0, lpBuffer=0x27d7124, nNumberOfBytesToRead=0x5da7, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x27d7124*, lpNumberOfBytesRead=0x8fe75c*=0x5da7, lpOverlapped=0x0) returned 1 [0078.327] CloseHandle (hObject=0x2d0) returned 1 [0078.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf", lpFilePart=0x0) returned 0x3f [0078.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0078.343] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\pkl09b9n4k64qd-ayvvx.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.344] GetFileType (hFile=0x2d0) returned 0x1 [0078.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0078.344] GetFileType (hFile=0x2d0) returned 0x1 [0078.344] WriteFile (in: hFile=0x2d0, lpBuffer=0x2841398*, nNumberOfBytesToWrite=0x5db0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2841398*, lpNumberOfBytesWritten=0x8fe74c*=0x5db0, lpOverlapped=0x0) returned 1 [0078.345] CloseHandle (hObject=0x2d0) returned 1 [0078.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf", lpFilePart=0x0) returned 0x3f [0078.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6a [0078.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0078.346] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\pkl09b9n4k64qd-ayvvx.swf"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8991d370, ftCreationTime.dwHighDateTime=0x1d6255d, ftLastAccessTime.dwLowDateTime=0xc1f19ca0, ftLastAccessTime.dwHighDateTime=0x1d62ac1, ftLastWriteTime.dwLowDateTime=0x8ac11412, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5db0)) returned 1 [0078.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0078.346] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\pkl09b9n4k64qd-ayvvx.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\pKl09b9N4K64qD-AyvVX.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\pkl09b9n4k64qd-ayvvx.swf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0078.349] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv", lpFilePart=0x0) returned 0x37 [0078.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0078.349] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\zfbp7ilclqzn.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.350] GetFileType (hFile=0x2d0) returned 0x1 [0078.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0078.350] GetFileType (hFile=0x2d0) returned 0x1 [0078.350] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x10d46 [0078.350] ReadFile (in: hFile=0x2d0, lpBuffer=0x2847630, nNumberOfBytesToRead=0x10d46, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2847630*, lpNumberOfBytesRead=0x8fe75c*=0x10d46, lpOverlapped=0x0) returned 1 [0078.350] CloseHandle (hObject=0x2d0) returned 1 [0078.415] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv", lpFilePart=0x0) returned 0x37 [0078.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0078.416] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\zfbp7ilclqzn.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.417] GetFileType (hFile=0x2d0) returned 0x1 [0078.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0078.417] GetFileType (hFile=0x2d0) returned 0x1 [0078.417] WriteFile (in: hFile=0x2d0, lpBuffer=0x28c6c38*, nNumberOfBytesToWrite=0x10d50, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28c6c38*, lpNumberOfBytesWritten=0x8fe74c*=0x10d50, lpOverlapped=0x0) returned 1 [0078.418] CloseHandle (hObject=0x2d0) returned 1 [0078.420] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv", lpFilePart=0x0) returned 0x37 [0078.420] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x62 [0078.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0078.420] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\zfbp7ilclqzn.flv"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcca6900, ftCreationTime.dwHighDateTime=0x1d631e2, ftLastAccessTime.dwLowDateTime=0x72ed6050, ftLastAccessTime.dwHighDateTime=0x1d631d6, ftLastWriteTime.dwLowDateTime=0x8aca9ed6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10d50)) returned 1 [0078.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0078.420] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\zfbp7ilclqzn.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\ZfbP7IlCLQZN.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\zfbp7ilclqzn.flv.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0078.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0078.421] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH", lpFilePart=0x0) returned 0x26 [0078.421] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f2ab80, ftCreationTime.dwHighDateTime=0x1d627ff, ftLastAccessTime.dwLowDateTime=0x8aca9ed6, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8aca9ed6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0078.421] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f2ab80, ftCreationTime.dwHighDateTime=0x1d627ff, ftLastAccessTime.dwLowDateTime=0x8aca9ed6, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8aca9ed6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.421] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd18780, ftCreationTime.dwHighDateTime=0x1d625f0, ftLastAccessTime.dwLowDateTime=0xa5027680, ftLastAccessTime.dwHighDateTime=0x1d62dde, ftLastWriteTime.dwLowDateTime=0x8a8f044d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa090, dwReserved0=0x0, dwReserved1=0x0, cFileName="-AyXsbLXi4y2WQ2cPlg.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="-AYXSB~1.MAD")) returned 1 [0078.421] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x639b9b70, ftCreationTime.dwHighDateTime=0x1d623ea, ftLastAccessTime.dwLowDateTime=0xfdaf9ec0, ftLastAccessTime.dwHighDateTime=0x1d6251e, ftLastWriteTime.dwLowDateTime=0x8aa21841, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x17310, dwReserved0=0x0, dwReserved1=0x0, cFileName="-CT6Zdjo20Jv.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="-CT6ZD~1.MAD")) returned 1 [0078.421] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97587210, ftCreationTime.dwHighDateTime=0x1d62ff4, ftLastAccessTime.dwLowDateTime=0xd715dca0, ftLastAccessTime.dwHighDateTime=0x1d62c23, ftLastWriteTime.dwLowDateTime=0xd715dca0, ftLastWriteTime.dwHighDateTime=0x1d62c23, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hE 46Qf3w3ad94", cAlternateFileName="HE46QF~1")) returned 1 [0078.422] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60d254d0, ftCreationTime.dwHighDateTime=0x1d62604, ftLastAccessTime.dwLowDateTime=0x74656030, ftLastAccessTime.dwHighDateTime=0x1d630ab, ftLastWriteTime.dwLowDateTime=0x74656030, ftLastWriteTime.dwHighDateTime=0x1d630ab, nFileSizeHigh=0x0, nFileSizeLow=0x3918, dwReserved0=0x0, dwReserved1=0x0, cFileName="iCFea5v.mkv", cAlternateFileName="")) returned 1 [0078.422] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x299e5360, ftCreationTime.dwHighDateTime=0x1d626e0, ftLastAccessTime.dwLowDateTime=0x1bec7420, ftLastAccessTime.dwHighDateTime=0x1d627a0, ftLastWriteTime.dwLowDateTime=0x8aae01ad, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd220, dwReserved0=0x0, dwReserved1=0x0, cFileName="N4usFdd_QP3Q50uG.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="N4USFD~1.MAD")) returned 1 [0078.422] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9fa210, ftCreationTime.dwHighDateTime=0x1d623fa, ftLastAccessTime.dwLowDateTime=0x338d01a0, ftLastAccessTime.dwHighDateTime=0x1d631bc, ftLastWriteTime.dwLowDateTime=0x8abc50ba, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10dc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oXXecVesFjY.avi.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="OXXECV~1.MAD")) returned 1 [0078.422] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8991d370, ftCreationTime.dwHighDateTime=0x1d6255d, ftLastAccessTime.dwLowDateTime=0xc1f19ca0, ftLastAccessTime.dwHighDateTime=0x1d62ac1, ftLastWriteTime.dwLowDateTime=0x8ac11412, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pKl09b9N4K64qD-AyvVX.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="PKL09B~1.MAD")) returned 1 [0078.422] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcca6900, ftCreationTime.dwHighDateTime=0x1d631e2, ftLastAccessTime.dwLowDateTime=0x72ed6050, ftLastAccessTime.dwHighDateTime=0x1d631d6, ftLastWriteTime.dwLowDateTime=0x8aca9ed6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZfbP7IlCLQZN.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ZFBP7I~1.MAD")) returned 1 [0078.422] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcca6900, ftCreationTime.dwHighDateTime=0x1d631e2, ftLastAccessTime.dwLowDateTime=0x72ed6050, ftLastAccessTime.dwHighDateTime=0x1d631d6, ftLastWriteTime.dwLowDateTime=0x8aca9ed6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZfbP7IlCLQZN.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="ZFBP7I~1.MAD")) returned 0 [0078.422] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0078.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0078.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0078.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94", nBufferLength=0x105, lpBuffer=0x8fe250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94", lpFilePart=0x0) returned 0x35 [0078.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0078.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94", lpFilePart=0x0) returned 0x35 [0078.423] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97587210, ftCreationTime.dwHighDateTime=0x1d62ff4, ftLastAccessTime.dwLowDateTime=0xd715dca0, ftLastAccessTime.dwHighDateTime=0x1d62c23, ftLastWriteTime.dwLowDateTime=0xd715dca0, ftLastWriteTime.dwHighDateTime=0x1d62c23, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1308 [0078.425] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97587210, ftCreationTime.dwHighDateTime=0x1d62ff4, ftLastAccessTime.dwLowDateTime=0xd715dca0, ftLastAccessTime.dwHighDateTime=0x1d62c23, ftLastWriteTime.dwLowDateTime=0xd715dca0, ftLastWriteTime.dwHighDateTime=0x1d62c23, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.426] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdabc8f0, ftCreationTime.dwHighDateTime=0x1d62afe, ftLastAccessTime.dwLowDateTime=0xd03c5750, ftLastAccessTime.dwHighDateTime=0x1d62a3f, ftLastWriteTime.dwLowDateTime=0xd03c5750, ftLastWriteTime.dwHighDateTime=0x1d62a3f, nFileSizeHigh=0x0, nFileSizeLow=0xa980, dwReserved0=0x0, dwReserved1=0x0, cFileName="51-LsR66Yj2XL6I.mkv", cAlternateFileName="51-LSR~1.MKV")) returned 1 [0078.426] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa646b680, ftCreationTime.dwHighDateTime=0x1d626b0, ftLastAccessTime.dwLowDateTime=0xf126c2e0, ftLastAccessTime.dwHighDateTime=0x1d62a83, ftLastWriteTime.dwLowDateTime=0xf126c2e0, ftLastWriteTime.dwHighDateTime=0x1d62a83, nFileSizeHigh=0x0, nFileSizeLow=0x177b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="DJePvN9FcYsHQZ.mkv", cAlternateFileName="DJEPVN~1.MKV")) returned 1 [0078.426] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f6b0c20, ftCreationTime.dwHighDateTime=0x1d6261d, ftLastAccessTime.dwLowDateTime=0x2c99c780, ftLastAccessTime.dwHighDateTime=0x1d63201, ftLastWriteTime.dwLowDateTime=0x2c99c780, ftLastWriteTime.dwHighDateTime=0x1d63201, nFileSizeHigh=0x0, nFileSizeLow=0xde81, dwReserved0=0x0, dwReserved1=0x0, cFileName="GLbdVtLE8VzZK2t.flv", cAlternateFileName="GLBDVT~1.FLV")) returned 1 [0078.426] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ac38f0, ftCreationTime.dwHighDateTime=0x1d62e7c, ftLastAccessTime.dwLowDateTime=0xeb1a8780, ftLastAccessTime.dwHighDateTime=0x1d62711, ftLastWriteTime.dwLowDateTime=0xeb1a8780, ftLastWriteTime.dwHighDateTime=0x1d62711, nFileSizeHigh=0x0, nFileSizeLow=0xf820, dwReserved0=0x0, dwReserved1=0x0, cFileName="IKZI-kFZ_e8 BubM.flv", cAlternateFileName="IKZI-K~1.FLV")) returned 1 [0078.426] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e09540, ftCreationTime.dwHighDateTime=0x1d625a9, ftLastAccessTime.dwLowDateTime=0x4e2e1f30, ftLastAccessTime.dwHighDateTime=0x1d62a64, ftLastWriteTime.dwLowDateTime=0x4e2e1f30, ftLastWriteTime.dwHighDateTime=0x1d62a64, nFileSizeHigh=0x0, nFileSizeLow=0xf42f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQ4tjznftO8FH4DMW.swf", cAlternateFileName="SQ4TJZ~1.SWF")) returned 1 [0078.426] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x228020b0, ftCreationTime.dwHighDateTime=0x1d631f1, ftLastAccessTime.dwLowDateTime=0x20692200, ftLastAccessTime.dwHighDateTime=0x1d62313, ftLastWriteTime.dwLowDateTime=0x20692200, ftLastWriteTime.dwHighDateTime=0x1d62313, nFileSizeHigh=0x0, nFileSizeLow=0x18243, dwReserved0=0x0, dwReserved1=0x0, cFileName="TuZFfsgqZM.mkv", cAlternateFileName="TUZFFS~1.MKV")) returned 1 [0078.426] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58dda720, ftCreationTime.dwHighDateTime=0x1d62f87, ftLastAccessTime.dwLowDateTime=0xca6bb5c0, ftLastAccessTime.dwHighDateTime=0x1d622e5, ftLastWriteTime.dwLowDateTime=0xca6bb5c0, ftLastWriteTime.dwHighDateTime=0x1d622e5, nFileSizeHigh=0x0, nFileSizeLow=0x15da6, dwReserved0=0x0, dwReserved1=0x0, cFileName="YmpTO3-QPETNgA9IZUlJ.mp4", cAlternateFileName="YMPTO3~1.MP4")) returned 1 [0078.426] FindNextFileW (in: hFindFile=0xac1308, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.426] FindClose (in: hFindFile=0xac1308 | out: hFindFile=0xac1308) returned 1 [0078.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0078.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0078.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv", lpFilePart=0x0) returned 0x49 [0078.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0078.427] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\glbdvtle8vzzk2t.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.427] GetFileType (hFile=0x2d0) returned 0x1 [0078.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0078.427] GetFileType (hFile=0x2d0) returned 0x1 [0078.427] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0xde81 [0078.427] ReadFile (in: hFile=0x2d0, lpBuffer=0x28db0a8, nNumberOfBytesToRead=0xde81, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x28db0a8*, lpNumberOfBytesRead=0x8fe718*=0xde81, lpOverlapped=0x0) returned 1 [0078.428] CloseHandle (hObject=0x2d0) returned 1 [0078.526] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv", lpFilePart=0x0) returned 0x49 [0078.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0078.526] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\glbdvtle8vzzk2t.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.527] GetFileType (hFile=0x2d0) returned 0x1 [0078.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0078.527] GetFileType (hFile=0x2d0) returned 0x1 [0078.527] WriteFile (in: hFile=0x2d0, lpBuffer=0x27454f4*, nNumberOfBytesToWrite=0xde90, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x27454f4*, lpNumberOfBytesWritten=0x8fe708*=0xde90, lpOverlapped=0x0) returned 1 [0078.528] CloseHandle (hObject=0x2d0) returned 1 [0078.530] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv", lpFilePart=0x0) returned 0x49 [0078.530] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x74 [0078.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0078.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\glbdvtle8vzzk2t.flv"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f6b0c20, ftCreationTime.dwHighDateTime=0x1d6261d, ftLastAccessTime.dwLowDateTime=0x2c99c780, ftLastAccessTime.dwHighDateTime=0x1d63201, ftLastWriteTime.dwLowDateTime=0x8adb4ed7, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xde90)) returned 1 [0078.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0078.530] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\glbdvtle8vzzk2t.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\GLbdVtLE8VzZK2t.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\glbdvtle8vzzk2t.flv.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0078.531] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv", lpFilePart=0x0) returned 0x4a [0078.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0078.531] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\ikzi-kfz_e8 bubm.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.531] GetFileType (hFile=0x2d0) returned 0x1 [0078.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0078.531] GetFileType (hFile=0x2d0) returned 0x1 [0078.531] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0xf820 [0078.531] ReadFile (in: hFile=0x2d0, lpBuffer=0x27538e0, nNumberOfBytesToRead=0xf820, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x27538e0*, lpNumberOfBytesRead=0x8fe718*=0xf820, lpOverlapped=0x0) returned 1 [0078.531] CloseHandle (hObject=0x2d0) returned 1 [0078.602] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv", lpFilePart=0x0) returned 0x4a [0078.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0078.602] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\ikzi-kfz_e8 bubm.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.603] GetFileType (hFile=0x2d0) returned 0x1 [0078.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0078.603] GetFileType (hFile=0x2d0) returned 0x1 [0078.603] WriteFile (in: hFile=0x2d0, lpBuffer=0x27cf0e0*, nNumberOfBytesToWrite=0xf830, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x27cf0e0*, lpNumberOfBytesWritten=0x8fe708*=0xf830, lpOverlapped=0x0) returned 1 [0078.604] CloseHandle (hObject=0x2d0) returned 1 [0078.606] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv", lpFilePart=0x0) returned 0x4a [0078.606] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x75 [0078.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0078.606] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\ikzi-kfz_e8 bubm.flv"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ac38f0, ftCreationTime.dwHighDateTime=0x1d62e7c, ftLastAccessTime.dwLowDateTime=0xeb1a8780, ftLastAccessTime.dwHighDateTime=0x1d62711, ftLastWriteTime.dwLowDateTime=0x8ae73afd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf830)) returned 1 [0078.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0078.606] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\ikzi-kfz_e8 bubm.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\IKZI-kFZ_e8 BubM.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\ikzi-kfz_e8 bubm.flv.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0078.607] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf", lpFilePart=0x0) returned 0x4b [0078.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0078.607] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\sq4tjznfto8fh4dmw.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.607] GetFileType (hFile=0x2d0) returned 0x1 [0078.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0078.607] GetFileType (hFile=0x2d0) returned 0x1 [0078.607] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0xf42f [0078.607] ReadFile (in: hFile=0x2d0, lpBuffer=0x27dee78, nNumberOfBytesToRead=0xf42f, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x27dee78*, lpNumberOfBytesRead=0x8fe718*=0xf42f, lpOverlapped=0x0) returned 1 [0078.608] CloseHandle (hObject=0x2d0) returned 1 [0078.626] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf", lpFilePart=0x0) returned 0x4b [0078.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0078.626] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\sq4tjznfto8fh4dmw.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.627] GetFileType (hFile=0x2d0) returned 0x1 [0078.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0078.627] GetFileType (hFile=0x2d0) returned 0x1 [0078.627] WriteFile (in: hFile=0x2d0, lpBuffer=0x2859920*, nNumberOfBytesToWrite=0xf430, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x2859920*, lpNumberOfBytesWritten=0x8fe708*=0xf430, lpOverlapped=0x0) returned 1 [0078.628] CloseHandle (hObject=0x2d0) returned 1 [0078.630] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf", lpFilePart=0x0) returned 0x4b [0078.630] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x76 [0078.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0078.630] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\sq4tjznfto8fh4dmw.swf"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e09540, ftCreationTime.dwHighDateTime=0x1d625a9, ftLastAccessTime.dwLowDateTime=0x4e2e1f30, ftLastAccessTime.dwHighDateTime=0x1d62a64, ftLastWriteTime.dwLowDateTime=0x8aec001b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf430)) returned 1 [0078.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0078.630] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\sq4tjznfto8fh4dmw.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\SQ4tjznftO8FH4DMW.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\sq4tjznfto8fh4dmw.swf.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0078.631] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4", lpFilePart=0x0) returned 0x4e [0078.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0078.631] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\ympto3-qpetnga9izulj.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.631] GetFileType (hFile=0x2d0) returned 0x1 [0078.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0078.631] GetFileType (hFile=0x2d0) returned 0x1 [0078.631] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x15da6 [0078.631] ReadFile (in: hFile=0x2d0, lpBuffer=0x384b9b8, nNumberOfBytesToRead=0x15da6, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x384b9b8*, lpNumberOfBytesRead=0x8fe718*=0x15da6, lpOverlapped=0x0) returned 1 [0078.633] CloseHandle (hObject=0x2d0) returned 1 [0078.781] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4", lpFilePart=0x0) returned 0x4e [0078.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0078.781] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\ympto3-qpetnga9izulj.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.782] GetFileType (hFile=0x2d0) returned 0x1 [0078.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0078.783] GetFileType (hFile=0x2d0) returned 0x1 [0078.783] WriteFile (in: hFile=0x2d0, lpBuffer=0x38b8e60*, nNumberOfBytesToWrite=0x15db0, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x38b8e60*, lpNumberOfBytesWritten=0x8fe708*=0x15db0, lpOverlapped=0x0) returned 1 [0078.784] CloseHandle (hObject=0x2d0) returned 1 [0078.786] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4", lpFilePart=0x0) returned 0x4e [0078.786] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x79 [0078.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0078.786] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\ympto3-qpetnga9izulj.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58dda720, ftCreationTime.dwHighDateTime=0x1d62f87, ftLastAccessTime.dwLowDateTime=0xca6bb5c0, ftLastAccessTime.dwHighDateTime=0x1d622e5, ftLastWriteTime.dwLowDateTime=0x8b03d870, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15db0)) returned 1 [0078.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0078.786] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\ympto3-qpetnga9izulj.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\YmpTO3-QPETNgA9IZUlJ.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\users\\fd1hvy\\videos\\vrjm2guezlzouoh\\he 46qf3w3ad94\\ympto3-qpetnga9izulj.mp4.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0078.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0078.787] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94", lpFilePart=0x0) returned 0x35 [0078.787] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VrjM2gUeZLzouOH\\hE 46Qf3w3ad94\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97587210, ftCreationTime.dwHighDateTime=0x1d62ff4, ftLastAccessTime.dwLowDateTime=0x8b03d870, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8b03d870, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e88 [0078.787] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97587210, ftCreationTime.dwHighDateTime=0x1d62ff4, ftLastAccessTime.dwLowDateTime=0x8b03d870, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8b03d870, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.787] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdabc8f0, ftCreationTime.dwHighDateTime=0x1d62afe, ftLastAccessTime.dwLowDateTime=0xd03c5750, ftLastAccessTime.dwHighDateTime=0x1d62a3f, ftLastWriteTime.dwLowDateTime=0xd03c5750, ftLastWriteTime.dwHighDateTime=0x1d62a3f, nFileSizeHigh=0x0, nFileSizeLow=0xa980, dwReserved0=0x0, dwReserved1=0x0, cFileName="51-LsR66Yj2XL6I.mkv", cAlternateFileName="51-LSR~1.MKV")) returned 1 [0078.787] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa646b680, ftCreationTime.dwHighDateTime=0x1d626b0, ftLastAccessTime.dwLowDateTime=0xf126c2e0, ftLastAccessTime.dwHighDateTime=0x1d62a83, ftLastWriteTime.dwLowDateTime=0xf126c2e0, ftLastWriteTime.dwHighDateTime=0x1d62a83, nFileSizeHigh=0x0, nFileSizeLow=0x177b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="DJePvN9FcYsHQZ.mkv", cAlternateFileName="DJEPVN~1.MKV")) returned 1 [0078.788] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f6b0c20, ftCreationTime.dwHighDateTime=0x1d6261d, ftLastAccessTime.dwLowDateTime=0x2c99c780, ftLastAccessTime.dwHighDateTime=0x1d63201, ftLastWriteTime.dwLowDateTime=0x8adb4ed7, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xde90, dwReserved0=0x0, dwReserved1=0x0, cFileName="GLbdVtLE8VzZK2t.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="GLBDVT~1.MAD")) returned 1 [0078.788] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ac38f0, ftCreationTime.dwHighDateTime=0x1d62e7c, ftLastAccessTime.dwLowDateTime=0xeb1a8780, ftLastAccessTime.dwHighDateTime=0x1d62711, ftLastWriteTime.dwLowDateTime=0x8ae73afd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf830, dwReserved0=0x0, dwReserved1=0x0, cFileName="IKZI-kFZ_e8 BubM.flv.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="IKZI-K~1.MAD")) returned 1 [0078.788] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e09540, ftCreationTime.dwHighDateTime=0x1d625a9, ftLastAccessTime.dwLowDateTime=0x4e2e1f30, ftLastAccessTime.dwHighDateTime=0x1d62a64, ftLastWriteTime.dwLowDateTime=0x8aec001b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf430, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQ4tjznftO8FH4DMW.swf.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="SQ4TJZ~1.MAD")) returned 1 [0078.788] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x228020b0, ftCreationTime.dwHighDateTime=0x1d631f1, ftLastAccessTime.dwLowDateTime=0x20692200, ftLastAccessTime.dwHighDateTime=0x1d62313, ftLastWriteTime.dwLowDateTime=0x20692200, ftLastWriteTime.dwHighDateTime=0x1d62313, nFileSizeHigh=0x0, nFileSizeLow=0x18243, dwReserved0=0x0, dwReserved1=0x0, cFileName="TuZFfsgqZM.mkv", cAlternateFileName="TUZFFS~1.MKV")) returned 1 [0078.788] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58dda720, ftCreationTime.dwHighDateTime=0x1d62f87, ftLastAccessTime.dwLowDateTime=0xca6bb5c0, ftLastAccessTime.dwHighDateTime=0x1d622e5, ftLastWriteTime.dwLowDateTime=0x8b03d870, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YmpTO3-QPETNgA9IZUlJ.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="YMPTO3~1.MAD")) returned 1 [0078.788] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58dda720, ftCreationTime.dwHighDateTime=0x1d62f87, ftLastAccessTime.dwLowDateTime=0xca6bb5c0, ftLastAccessTime.dwHighDateTime=0x1d622e5, ftLastWriteTime.dwLowDateTime=0x8b03d870, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x15db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YmpTO3-QPETNgA9IZUlJ.mp4.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="YMPTO3~1.MAD")) returned 0 [0078.788] FindClose (in: hFindFile=0xac0e88 | out: hFindFile=0xac0e88) returned 1 [0078.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0078.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0078.788] GetFullPathNameW (in: lpFileName="C:\\Users\\Public", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf [0078.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0078.788] GetFullPathNameW (in: lpFileName="C:\\Users\\Public", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf [0078.788] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0078.789] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.789] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0078.789] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0078.789] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.789] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0078.789] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0078.789] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0078.789] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0078.789] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0078.790] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0078.790] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0078.790] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0078.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0078.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0078.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0078.790] GetFullPathNameW (in: lpFileName="C:\\Users\\Public", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf [0078.790] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1008 [0078.790] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.790] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0078.790] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0078.790] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.790] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0078.791] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0078.791] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0078.791] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0078.791] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0078.791] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0078.791] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.791] FindClose (in: hFindFile=0xac1008 | out: hFindFile=0xac1008) returned 1 [0078.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0078.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0078.791] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0078.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0078.791] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0078.791] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e88 [0078.796] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.796] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.796] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0078.796] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0078.796] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0078.796] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0078.796] FindClose (in: hFindFile=0xac0e88 | out: hFindFile=0xac0e88) returned 1 [0078.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0078.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0078.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0078.797] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0078.797] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e88 [0078.798] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.798] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.798] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0078.798] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0078.798] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0078.798] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.798] FindClose (in: hFindFile=0xac0e88 | out: hFindFile=0xac0e88) returned 1 [0078.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0078.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0078.799] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19 [0078.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0078.799] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19 [0078.799] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1188 [0078.799] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.799] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.800] FindNextFileW (in: hFindFile=0xac1188, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.800] FindClose (in: hFindFile=0xac1188 | out: hFindFile=0xac1188) returned 1 [0078.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0078.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0078.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0078.800] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19 [0078.800] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac13c8 [0078.800] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.800] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.800] FindNextFileW (in: hFindFile=0xac13c8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0078.800] FindClose (in: hFindFile=0xac13c8 | out: hFindFile=0xac13c8) returned 1 [0078.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0078.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0078.801] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0078.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0078.801] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0078.801] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1248 [0078.801] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.801] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.801] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.801] FindClose (in: hFindFile=0xac1248 | out: hFindFile=0xac1248) returned 1 [0078.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0078.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0078.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0078.801] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0078.801] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0078.802] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.802] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.802] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0078.802] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0078.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0078.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0078.802] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0078.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0078.802] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0078.802] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1348 [0078.802] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.802] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.803] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.803] FindClose (in: hFindFile=0xac1348 | out: hFindFile=0xac1348) returned 1 [0078.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0078.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0078.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0078.803] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0078.803] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1348 [0078.803] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.803] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.803] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0078.803] FindClose (in: hFindFile=0xac1348 | out: hFindFile=0xac1348) returned 1 [0078.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0078.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0078.803] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0078.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0078.804] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0078.804] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0078.804] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.804] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.804] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.804] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0078.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0078.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0078.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0078.804] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0078.804] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1408 [0078.804] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.805] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.805] FindNextFileW (in: hFindFile=0xac1408, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0078.805] FindClose (in: hFindFile=0xac1408 | out: hFindFile=0xac1408) returned 1 [0078.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0078.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0078.805] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade", nBufferLength=0x105, lpBuffer=0x8fe360, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade", lpFilePart=0x0) returned 0x13 [0078.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe878) returned 1 [0078.805] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade", nBufferLength=0x105, lpBuffer=0x8fe32c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade", lpFilePart=0x0) returned 0x13 [0078.805] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\*", lpFindFileData=0x8fe5a0 | out: lpFindFileData=0x8fe5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0fc8 [0078.869] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.869] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0078.869] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3659ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3659ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x704c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appraiserxp.dll", cAlternateFileName="APPRAI~1.DLL")) returned 1 [0078.869] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36cf08, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36cf08, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootsect.exe", cAlternateFileName="")) returned 1 [0078.870] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea350dad, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea350dad, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xb08c3ee, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration.ini", cAlternateFileName="CONFIG~1.INI")) returned 1 [0078.870] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36e29e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36e29e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xf0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cosquery.dll", cAlternateFileName="")) returned 1 [0078.870] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea370998, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea370998, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x508c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DevInv.dll", cAlternateFileName="")) returned 1 [0078.870] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea377ed3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dll1", cAlternateFileName="")) returned 1 [0078.870] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37cd05, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dll2", cAlternateFileName="")) returned 1 [0078.870] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea380798, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea380798, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x326c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="downloader.dll", cAlternateFileName="DOWNLO~1.DLL")) returned 1 [0078.870] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea381b2a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea381b2a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9d2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0078.870] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea385605, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea385605, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xc2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWDCW20.DLL", cAlternateFileName="")) returned 1 [0078.870] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea386943, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea386943, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xb2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0078.870] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea387cd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea387cd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2652, dwReserved0=0x0, dwReserved1=0x0, cFileName="EnableWiFiTracing.cmd", cAlternateFileName="ENABLE~1.CMD")) returned 1 [0078.870] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea389060, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea389060, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x10cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESDHelper.dll", cAlternateFileName="ESDHEL~1.DLL")) returned 1 [0078.870] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38cadd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38cadd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="esdstub.dll", cAlternateFileName="")) returned 1 [0078.871] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38de7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38de7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x89ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherOSState.EXE", cAlternateFileName="GATHER~1.EXE")) returned 1 [0078.871] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39058e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39058e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x83cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentDeploy.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0078.871] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea392ca4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea392ca4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~2.DLL")) returned 1 [0078.871] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39539e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39539e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x11ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.EXE", cAlternateFileName="GETCUR~1.EXE")) returned 1 [0078.871] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39673d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39673d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x6cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HttpHelper.exe", cAlternateFileName="HTTPHE~1.EXE")) returned 1 [0078.871] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PostOOBEScript.cmd", cAlternateFileName="POSTOO~1.CMD")) returned 1 [0078.871] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0078.871] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea9ef415, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea9ef415, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x624407ed, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0x3d14a, dwReserved0=0x0, dwReserved1=0x0, cFileName="upgrader_default.log", cAlternateFileName="UPGRAD~1.LOG")) returned 1 [0078.871] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccdc86a8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x32fe02cc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x0, cFileName="upgrader_win10.log", cAlternateFileName="UPGRAD~2.LOG")) returned 1 [0078.871] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63f06a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63f06a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x880c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wimgapi.dll", cAlternateFileName="")) returned 1 [0078.872] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea642af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea642af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xdf8c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="windlp.dll", cAlternateFileName="")) returned 1 [0078.872] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64a022, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64a022, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x159ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows10UpgraderApp.exe", cAlternateFileName="WINDOW~1.EXE")) returned 1 [0078.872] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64ee41, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64ee41, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp32.exe", cAlternateFileName="WINREB~1.EXE")) returned 1 [0078.872] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 1 [0078.872] FindNextFileW (in: hFindFile=0xac0fc8, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.872] FindClose (in: hFindFile=0xac0fc8 | out: hFindFile=0xac0fc8) returned 1 [0078.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe834) returned 1 [0078.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe840) returned 1 [0078.873] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\upgrader_default.log", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\upgrader_default.log", lpFilePart=0x0) returned 0x28 [0078.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe780) returned 1 [0078.873] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.879] GetFileType (hFile=0x2d0) returned 0x1 [0078.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe77c) returned 1 [0078.879] GetFileType (hFile=0x2d0) returned 0x1 [0078.879] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe87c | out: lpFileSizeHigh=0x8fe87c*=0x0) returned 0x3d14a [0078.880] ReadFile (in: hFile=0x2d0, lpBuffer=0x38cec30, nNumberOfBytesToRead=0x3d14a, lpNumberOfBytesRead=0x8fe828, lpOverlapped=0x0 | out: lpBuffer=0x38cec30*, lpNumberOfBytesRead=0x8fe828*=0x3d14a, lpOverlapped=0x0) returned 1 [0078.888] CloseHandle (hObject=0x2d0) returned 1 [0078.958] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\upgrader_default.log", nBufferLength=0x105, lpBuffer=0x8fe224, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\upgrader_default.log", lpFilePart=0x0) returned 0x28 [0078.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0078.958] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.960] GetFileType (hFile=0x2d0) returned 0x1 [0078.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe764) returned 1 [0078.960] GetFileType (hFile=0x2d0) returned 0x1 [0078.960] WriteFile (in: hFile=0x2d0, lpBuffer=0x36c98e8*, nNumberOfBytesToWrite=0x3d150, lpNumberOfBytesWritten=0x8fe818, lpOverlapped=0x0 | out: lpBuffer=0x36c98e8*, lpNumberOfBytesWritten=0x8fe818*=0x3d150, lpOverlapped=0x0) returned 1 [0078.963] CloseHandle (hObject=0x2d0) returned 1 [0078.967] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\upgrader_default.log", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\upgrader_default.log", lpFilePart=0x0) returned 0x28 [0078.967] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\upgrader_default.log.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\upgrader_default.log.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x53 [0078.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0078.967] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), fInfoLevelId=0x0, lpFileInformation=0x8fe87c | out: lpFileInformation=0x8fe87c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea9ef415, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea9ef415, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b1e11cd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3d150)) returned 1 [0078.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0078.968] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), lpNewFileName="C:\\Windows10Upgrade\\upgrader_default.log.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\upgrader_default.log.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0078.968] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\upgrader_win10.log", lpFilePart=0x0) returned 0x26 [0078.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe780) returned 1 [0078.968] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0078.969] GetFileType (hFile=0x2d0) returned 0x1 [0078.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe77c) returned 1 [0078.969] GetFileType (hFile=0x2d0) returned 0x1 [0078.969] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe87c | out: lpFileSizeHigh=0x8fe87c*=0x0) returned 0x5044 [0078.969] ReadFile (in: hFile=0x2d0, lpBuffer=0x26ec158, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x8fe828, lpOverlapped=0x0 | out: lpBuffer=0x26ec158*, lpNumberOfBytesRead=0x8fe828*=0x5044, lpOverlapped=0x0) returned 1 [0078.971] CloseHandle (hObject=0x2d0) returned 1 [0079.043] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log", nBufferLength=0x105, lpBuffer=0x8fe224, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\upgrader_win10.log", lpFilePart=0x0) returned 0x26 [0079.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0079.043] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0079.044] GetFileType (hFile=0x2d0) returned 0x1 [0079.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe764) returned 1 [0079.044] GetFileType (hFile=0x2d0) returned 0x1 [0079.044] WriteFile (in: hFile=0x2d0, lpBuffer=0x2752244*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x8fe818, lpOverlapped=0x0 | out: lpBuffer=0x2752244*, lpNumberOfBytesWritten=0x8fe818*=0x5050, lpOverlapped=0x0) returned 1 [0079.045] CloseHandle (hObject=0x2d0) returned 1 [0079.046] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\upgrader_win10.log", lpFilePart=0x0) returned 0x26 [0079.046] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe34c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\upgrader_win10.log.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x51 [0079.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0079.046] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), fInfoLevelId=0x0, lpFileInformation=0x8fe87c | out: lpFileInformation=0x8fe87c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccdc86a8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8b29fc22, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5050)) returned 1 [0079.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0079.046] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), lpNewFileName="C:\\Windows10Upgrade\\upgrader_win10.log.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\upgrader_win10.log.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe878) returned 1 [0079.047] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade", nBufferLength=0x105, lpBuffer=0x8fe32c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade", lpFilePart=0x0) returned 0x13 [0079.047] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\*", lpFindFileData=0x8fe5a0 | out: lpFindFileData=0x8fe5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b29fc22, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8b29fc22, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1008 [0079.047] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b29fc22, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8b29fc22, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.048] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0079.048] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3659ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3659ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x704c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appraiserxp.dll", cAlternateFileName="APPRAI~1.DLL")) returned 1 [0079.048] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36cf08, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36cf08, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootsect.exe", cAlternateFileName="")) returned 1 [0079.048] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea350dad, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea350dad, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xb08c3ee, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration.ini", cAlternateFileName="CONFIG~1.INI")) returned 1 [0079.048] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36e29e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36e29e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xf0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cosquery.dll", cAlternateFileName="")) returned 1 [0079.048] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea370998, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea370998, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x508c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DevInv.dll", cAlternateFileName="")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea377ed3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dll1", cAlternateFileName="")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37cd05, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dll2", cAlternateFileName="")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea380798, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea380798, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x326c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="downloader.dll", cAlternateFileName="DOWNLO~1.DLL")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea381b2a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea381b2a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9d2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea385605, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea385605, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xc2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWDCW20.DLL", cAlternateFileName="")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea386943, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea386943, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xb2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea387cd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea387cd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2652, dwReserved0=0x0, dwReserved1=0x0, cFileName="EnableWiFiTracing.cmd", cAlternateFileName="ENABLE~1.CMD")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea389060, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea389060, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x10cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESDHelper.dll", cAlternateFileName="ESDHEL~1.DLL")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38cadd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38cadd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="esdstub.dll", cAlternateFileName="")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38de7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38de7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x89ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherOSState.EXE", cAlternateFileName="GATHER~1.EXE")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39058e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39058e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x83cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentDeploy.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea392ca4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea392ca4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~2.DLL")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39539e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39539e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x11ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.EXE", cAlternateFileName="GETCUR~1.EXE")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39673d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39673d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x6cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HttpHelper.exe", cAlternateFileName="HTTPHE~1.EXE")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PostOOBEScript.cmd", cAlternateFileName="POSTOO~1.CMD")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea9ef415, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea9ef415, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b1e11cd, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3d150, dwReserved0=0x0, dwReserved1=0x0, cFileName="upgrader_default.log.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UPGRAD~1.MAD")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccdc86a8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8b29fc22, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x5050, dwReserved0=0x0, dwReserved1=0x0, cFileName="upgrader_win10.log.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UPGRAD~2.MAD")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63f06a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63f06a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x880c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wimgapi.dll", cAlternateFileName="")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea642af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea642af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xdf8c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="windlp.dll", cAlternateFileName="")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64a022, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64a022, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x159ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows10UpgraderApp.exe", cAlternateFileName="WINDOW~1.EXE")) returned 1 [0079.051] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64ee41, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64ee41, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp32.exe", cAlternateFileName="WINREB~1.EXE")) returned 1 [0079.051] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 1 [0079.051] FindNextFileW (in: hFindFile=0xac1008, lpFindFileData=0x8fe5ac | out: lpFindFileData=0x8fe5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 0 [0079.051] FindClose (in: hFindFile=0xac1008 | out: hFindFile=0xac1008) returned 1 [0079.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe834) returned 1 [0079.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe840) returned 1 [0079.051] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\2052", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\2052", lpFilePart=0x0) returned 0x18 [0079.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0079.051] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\2052", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\2052", lpFilePart=0x0) returned 0x18 [0079.051] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\2052\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0079.051] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.052] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 1 [0079.052] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.052] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0079.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0079.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0079.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0079.052] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\2052", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\2052", lpFilePart=0x0) returned 0x18 [0079.052] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\2052\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0079.052] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.052] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 1 [0079.052] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 0 [0079.052] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0079.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0079.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0079.053] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\dll1", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\dll1", lpFilePart=0x0) returned 0x18 [0079.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0079.053] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\dll1", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\dll1", lpFilePart=0x0) returned 0x18 [0079.053] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll1\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0079.055] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea376b75, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea376b75, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x204c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cosqueryxp.dll", cAlternateFileName="COSQUE~1.DLL")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea377ed3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x3b0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wdscore.dll", cAlternateFileName="")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.056] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0079.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0079.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0079.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0079.056] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\dll1", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\dll1", lpFilePart=0x0) returned 0x18 [0079.056] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll1\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1248 [0079.056] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea376b75, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea376b75, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x204c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cosqueryxp.dll", cAlternateFileName="COSQUE~1.DLL")) returned 1 [0079.057] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea377ed3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x3b0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wdscore.dll", cAlternateFileName="")) returned 1 [0079.057] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0079.057] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0079.057] FindClose (in: hFindFile=0xac1248 | out: hFindFile=0xac1248) returned 1 [0079.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0079.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0079.057] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\dll2", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\dll2", lpFilePart=0x0) returned 0x18 [0079.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0079.057] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\dll2", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\dll2", lpFilePart=0x0) returned 0x18 [0079.057] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll2\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0079.058] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.058] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0079.058] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.058] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0079.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0079.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0079.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0079.058] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\dll2", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\dll2", lpFilePart=0x0) returned 0x18 [0079.058] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll2\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0079.059] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.059] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0079.059] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0079.059] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0079.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0079.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0079.059] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources", nBufferLength=0x105, lpBuffer=0x8fe31c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources", lpFilePart=0x0) returned 0x1d [0079.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0079.059] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources", lpFilePart=0x0) returned 0x1d [0079.059] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0079.060] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.060] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a5195, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0079.060] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a78b4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a78b4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xc981b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompatShared.txt", cAlternateFileName="HWCOMP~1.TXT")) returned 1 [0079.060] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b1515, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="i386", cAlternateFileName="")) returned 1 [0079.060] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 1 [0079.060] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 0 [0079.060] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0079.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0079.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0079.061] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", nBufferLength=0x105, lpBuffer=0x8fe1f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", lpFilePart=0x0) returned 0x30 [0079.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe73c) returned 1 [0079.061] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0079.061] GetFileType (hFile=0x2d0) returned 0x1 [0079.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe738) returned 1 [0079.061] GetFileType (hFile=0x2d0) returned 0x1 [0079.061] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe838 | out: lpFileSizeHigh=0x8fe838*=0x0) returned 0xc981b [0079.063] ReadFile (in: hFile=0x2d0, lpBuffer=0x3706a58, nNumberOfBytesToRead=0xc981b, lpNumberOfBytesRead=0x8fe7e4, lpOverlapped=0x0 | out: lpBuffer=0x3706a58*, lpNumberOfBytesRead=0x8fe7e4*=0xc981b, lpOverlapped=0x0) returned 1 [0079.069] CloseHandle (hObject=0x2d0) returned 1 [0079.199] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", nBufferLength=0x105, lpBuffer=0x8fe1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", lpFilePart=0x0) returned 0x30 [0079.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe724) returned 1 [0079.199] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.205] GetFileType (hFile=0xe4) returned 0x1 [0079.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe720) returned 1 [0079.205] GetFileType (hFile=0xe4) returned 0x1 [0079.205] WriteFile (in: hFile=0xe4, lpBuffer=0x3b93338*, nNumberOfBytesToWrite=0xc9820, lpNumberOfBytesWritten=0x8fe7d4, lpOverlapped=0x0 | out: lpBuffer=0x3b93338*, lpNumberOfBytesWritten=0x8fe7d4*=0xc9820, lpOverlapped=0x0) returned 1 [0079.214] CloseHandle (hObject=0xe4) returned 1 [0079.228] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", lpFilePart=0x0) returned 0x30 [0079.229] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe308, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5b [0079.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7bc) returned 1 [0079.229] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), fInfoLevelId=0x0, lpFileInformation=0x8fe838 | out: lpFileInformation=0x8fe838*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a78b4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a78b4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b469a53, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xc9820)) returned 1 [0079.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0079.229] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe834) returned 1 [0079.256] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources", nBufferLength=0x105, lpBuffer=0x8fe2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources", lpFilePart=0x0) returned 0x1d [0079.256] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\*", lpFindFileData=0x8fe55c | out: lpFindFileData=0x8fe55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b4b997d, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8b4b997d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1148 [0079.256] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b4b997d, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8b4b997d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.256] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a5195, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0079.256] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a78b4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a78b4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b469a53, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xc9820, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompatShared.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HWCOMP~1.MAD")) returned 1 [0079.257] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b1515, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="i386", cAlternateFileName="")) returned 1 [0079.257] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 1 [0079.257] FindNextFileW (in: hFindFile=0xac1148, lpFindFileData=0x8fe568 | out: lpFindFileData=0x8fe568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.257] FindClose (in: hFindFile=0xac1148 | out: hFindFile=0xac1148) returned 1 [0079.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f0) returned 1 [0079.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0079.257] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64", lpFilePart=0x0) returned 0x23 [0079.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0079.257] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64", lpFilePart=0x0) returned 0x23 [0079.257] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a652e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1508 [0079.262] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a652e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.262] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39b5b0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39b5b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0079.262] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39c8ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39c8ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x11daf, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0079.263] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39dcc9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39dcc9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x90d, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0079.263] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39eff9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39eff9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x26b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0079.263] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a3e27, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a3e27, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0079.263] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0079.263] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.263] FindClose (in: hFindFile=0xac1508 | out: hFindFile=0xac1508) returned 1 [0079.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0079.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0079.264] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", lpFilePart=0x0) returned 0x32 [0079.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.264] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.265] GetFileType (hFile=0xe4) returned 0x1 [0079.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.265] GetFileType (hFile=0xe4) returned 0x1 [0079.265] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x16ebc [0079.265] ReadFile (in: hFile=0xe4, lpBuffer=0x36c98e8, nNumberOfBytesToRead=0x16ebc, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x36c98e8*, lpNumberOfBytesRead=0x8fe7a0*=0x16ebc, lpOverlapped=0x0) returned 1 [0079.275] CloseHandle (hObject=0xe4) returned 1 [0079.326] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", lpFilePart=0x0) returned 0x32 [0079.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.326] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.328] GetFileType (hFile=0xe4) returned 0x1 [0079.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.328] GetFileType (hFile=0xe4) returned 0x1 [0079.328] WriteFile (in: hFile=0xe4, lpBuffer=0x373c2e0*, nNumberOfBytesToWrite=0x16ec0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x373c2e0*, lpNumberOfBytesWritten=0x8fe790*=0x16ec0, lpOverlapped=0x0) returned 1 [0079.330] CloseHandle (hObject=0xe4) returned 1 [0079.332] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", lpFilePart=0x0) returned 0x32 [0079.332] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5d [0079.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.332] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39b5b0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39b5b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b574956, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16ec0)) returned 1 [0079.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.332] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.333] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", lpFilePart=0x0) returned 0x30 [0079.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.333] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.333] GetFileType (hFile=0xe4) returned 0x1 [0079.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.333] GetFileType (hFile=0xe4) returned 0x1 [0079.333] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x11daf [0079.333] ReadFile (in: hFile=0xe4, lpBuffer=0x273dc74, nNumberOfBytesToRead=0x11daf, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x273dc74*, lpNumberOfBytesRead=0x8fe7a0*=0x11daf, lpOverlapped=0x0) returned 1 [0079.335] CloseHandle (hObject=0xe4) returned 1 [0079.353] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", lpFilePart=0x0) returned 0x30 [0079.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.353] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.354] GetFileType (hFile=0xe4) returned 0x1 [0079.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.354] GetFileType (hFile=0xe4) returned 0x1 [0079.354] WriteFile (in: hFile=0xe4, lpBuffer=0x27cfe54*, nNumberOfBytesToWrite=0x11db0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27cfe54*, lpNumberOfBytesWritten=0x8fe790*=0x11db0, lpOverlapped=0x0) returned 1 [0079.356] CloseHandle (hObject=0xe4) returned 1 [0079.357] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", lpFilePart=0x0) returned 0x30 [0079.357] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5b [0079.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.357] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39c8ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39c8ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b59abc8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11db0)) returned 1 [0079.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.358] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.358] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", lpFilePart=0x0) returned 0x31 [0079.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.358] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.358] GetFileType (hFile=0xe4) returned 0x1 [0079.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.358] GetFileType (hFile=0xe4) returned 0x1 [0079.359] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x90d [0079.359] ReadFile (in: hFile=0xe4, lpBuffer=0x27e2964, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27e2964*, lpNumberOfBytesRead=0x8fe7a0*=0x90d, lpOverlapped=0x0) returned 1 [0079.368] CloseHandle (hObject=0xe4) returned 1 [0079.388] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", lpFilePart=0x0) returned 0x31 [0079.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.388] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.389] GetFileType (hFile=0xe4) returned 0x1 [0079.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.389] GetFileType (hFile=0xe4) returned 0x1 [0079.389] WriteFile (in: hFile=0xe4, lpBuffer=0x28335b8*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x28335b8*, lpNumberOfBytesWritten=0x8fe764*=0x910, lpOverlapped=0x0) returned 1 [0079.390] CloseHandle (hObject=0xe4) returned 1 [0079.391] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", lpFilePart=0x0) returned 0x31 [0079.391] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5c [0079.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.391] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39dcc9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39dcc9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b5e7206, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x910)) returned 1 [0079.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.391] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0079.392] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\amd64", lpFilePart=0x0) returned 0x23 [0079.392] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b60d395, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8b60d395, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e48 [0079.392] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b60d395, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8b60d395, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.393] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39b5b0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39b5b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b574956, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BiosBlocks.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="BIOSBL~1.MAD")) returned 1 [0079.393] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39c8ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39c8ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b59abc8, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompat.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HWCOMP~1.MAD")) returned 1 [0079.393] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39dcc9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39dcc9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b5e7206, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwexclude.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HWEXCL~1.MAD")) returned 1 [0079.393] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39eff9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39eff9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x26b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0079.393] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a3e27, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a3e27, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0079.393] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0079.393] FindNextFileW (in: hFindFile=0xac0e48, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 0 [0079.393] FindClose (in: hFindFile=0xac0e48 | out: hFindFile=0xac0e48) returned 1 [0079.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0079.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0079.393] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386", lpFilePart=0x0) returned 0x22 [0079.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0079.393] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386", lpFilePart=0x0) returned 0x22 [0079.393] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b2895, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1548 [0079.395] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b2895, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.395] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ab347, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ab347, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0079.395] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ac6e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ac6e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4071, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0079.395] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ada69, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ada69, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0079.395] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3aedef, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3aedef, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2684, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0079.395] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b017f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b017f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0079.395] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0079.395] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.395] FindClose (in: hFindFile=0xac1548 | out: hFindFile=0xac1548) returned 1 [0079.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0079.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0079.396] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", lpFilePart=0x0) returned 0x31 [0079.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.396] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.397] GetFileType (hFile=0xe4) returned 0x1 [0079.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.397] GetFileType (hFile=0xe4) returned 0x1 [0079.397] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x16600 [0079.398] ReadFile (in: hFile=0xe4, lpBuffer=0x3776d20, nNumberOfBytesToRead=0x16600, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x3776d20*, lpNumberOfBytesRead=0x8fe7a0*=0x16600, lpOverlapped=0x0) returned 1 [0079.399] CloseHandle (hObject=0xe4) returned 1 [0079.458] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", lpFilePart=0x0) returned 0x31 [0079.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.458] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.459] GetFileType (hFile=0xe4) returned 0x1 [0079.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.459] GetFileType (hFile=0xe4) returned 0x1 [0079.459] WriteFile (in: hFile=0xe4, lpBuffer=0x37e6ba0*, nNumberOfBytesToWrite=0x16610, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x37e6ba0*, lpNumberOfBytesWritten=0x8fe790*=0x16610, lpOverlapped=0x0) returned 1 [0079.461] CloseHandle (hObject=0xe4) returned 1 [0079.463] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", lpFilePart=0x0) returned 0x31 [0079.463] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5c [0079.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.463] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ab347, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ab347, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b6a5b4d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16610)) returned 1 [0079.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.463] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.464] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", lpFilePart=0x0) returned 0x2f [0079.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.464] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.464] GetFileType (hFile=0xe4) returned 0x1 [0079.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.464] GetFileType (hFile=0xe4) returned 0x1 [0079.464] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x4071 [0079.464] ReadFile (in: hFile=0xe4, lpBuffer=0x2735080, nNumberOfBytesToRead=0x4071, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2735080*, lpNumberOfBytesRead=0x8fe7a0*=0x4071, lpOverlapped=0x0) returned 1 [0079.481] CloseHandle (hObject=0xe4) returned 1 [0079.499] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", lpFilePart=0x0) returned 0x2f [0079.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.499] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.500] GetFileType (hFile=0xe4) returned 0x1 [0079.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.500] GetFileType (hFile=0xe4) returned 0x1 [0079.500] WriteFile (in: hFile=0xe4, lpBuffer=0x2796260*, nNumberOfBytesToWrite=0x4080, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2796260*, lpNumberOfBytesWritten=0x8fe790*=0x4080, lpOverlapped=0x0) returned 1 [0079.507] CloseHandle (hObject=0xe4) returned 1 [0079.508] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", lpFilePart=0x0) returned 0x2f [0079.508] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5a [0079.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.508] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ac6e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ac6e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b7183b7, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4080)) returned 1 [0079.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.508] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.509] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", lpFilePart=0x0) returned 0x30 [0079.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.509] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.509] GetFileType (hFile=0xe4) returned 0x1 [0079.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.509] GetFileType (hFile=0xe4) returned 0x1 [0079.509] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x8d7 [0079.509] ReadFile (in: hFile=0xe4, lpBuffer=0x279b000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x279b000*, lpNumberOfBytesRead=0x8fe7a0*=0x8d7, lpOverlapped=0x0) returned 1 [0079.513] CloseHandle (hObject=0xe4) returned 1 [0079.528] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", lpFilePart=0x0) returned 0x30 [0079.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.528] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.529] GetFileType (hFile=0xe4) returned 0x1 [0079.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.529] GetFileType (hFile=0xe4) returned 0x1 [0079.529] WriteFile (in: hFile=0xe4, lpBuffer=0x27ebb6c*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x27ebb6c*, lpNumberOfBytesWritten=0x8fe764*=0x8e0, lpOverlapped=0x0) returned 1 [0079.531] CloseHandle (hObject=0xe4) returned 1 [0079.551] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", lpFilePart=0x0) returned 0x30 [0079.551] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5b [0079.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.551] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ada69, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ada69, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b78ab14, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8e0)) returned 1 [0079.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.552] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0079.552] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\i386", lpFilePart=0x0) returned 0x22 [0079.552] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b78ab14, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8b78ab14, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1348 [0079.552] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b78ab14, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8b78ab14, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.553] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ab347, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ab347, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b6a5b4d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x16610, dwReserved0=0x0, dwReserved1=0x0, cFileName="BiosBlocks.xml.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="BIOSBL~1.MAD")) returned 1 [0079.553] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ac6e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ac6e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b7183b7, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4080, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompat.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HWCOMP~1.MAD")) returned 1 [0079.553] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ada69, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ada69, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b78ab14, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwexclude.txt.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="HWEXCL~1.MAD")) returned 1 [0079.553] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3aedef, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3aedef, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2684, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0079.553] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b017f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b017f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0079.553] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0079.553] FindNextFileW (in: hFindFile=0xac1348, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 0 [0079.553] FindClose (in: hFindFile=0xac1348 | out: hFindFile=0xac1348) returned 1 [0079.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0079.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0079.553] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux", nBufferLength=0x105, lpBuffer=0x8fe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux", lpFilePart=0x0) returned 0x20 [0079.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0079.554] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux", lpFilePart=0x0) returned 0x20 [0079.554] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1248 [0079.556] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.556] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b4fa7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b4fa7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x0, dwReserved1=0x0, cFileName="block.png", cAlternateFileName="")) returned 1 [0079.556] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b8a24, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b8a24, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x1ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bluelogo.png", cAlternateFileName="")) returned 1 [0079.556] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b9dbd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b9dbd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="bullet.png", cAlternateFileName="")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bb141, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bb141, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.css", cAlternateFileName="")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bc4cd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bc4cd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf44d, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.htm", cAlternateFileName="")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bd859, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bd859, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x13e24500, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_eos.css", cAlternateFileName="DEFAUL~1.CSS")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bff6c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bff6c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea75e900, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0xda3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_eos.htm", cAlternateFileName="DEFAUL~1.HTM")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c12fc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c12fc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1468, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_oobe.css", cAlternateFileName="DEFAUL~2.CSS")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c2685, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c2685, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7f589b00, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x100ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_oobe.htm", cAlternateFileName="DEFAUL~2.HTM")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA", cAlternateFileName="")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.css", cAlternateFileName="")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStarted.png", cAlternateFileName="GETSTA~1.PNG")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedHoverOver.png", cAlternateFileName="GETSTA~2.PNG")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x43f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="loading.gif", cAlternateFileName="")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0xe5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="lock.png", cAlternateFileName="")) returned 1 [0079.558] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0079.558] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="marketing.png", cAlternateFileName="MARKET~1.PNG")) returned 1 [0079.558] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea60a72c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WinJS", cAlternateFileName="MICROS~1.WIN")) returned 1 [0079.558] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea627c0d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea627c0d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x97e0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkIssueFAQ.mht", cAlternateFileName="NETWOR~1.MHT")) returned 1 [0079.558] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x875, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoNetworkConnection.png", cAlternateFileName="NONETW~1.PNG")) returned 1 [0079.558] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoNetworkConnectionHoverOver.png", cAlternateFileName="NONETW~2.PNG")) returned 1 [0079.558] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="pass.png", cAlternateFileName="")) returned 1 [0079.558] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.558] FindClose (in: hFindFile=0xac1248 | out: hFindFile=0xac1248) returned 1 [0079.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0079.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0079.559] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\block.png", lpFilePart=0x0) returned 0x2a [0079.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.559] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.559] GetFileType (hFile=0xe4) returned 0x1 [0079.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.560] GetFileType (hFile=0xe4) returned 0x1 [0079.560] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x397 [0079.560] ReadFile (in: hFile=0xe4, lpBuffer=0x27f1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27f1088*, lpNumberOfBytesRead=0x8fe7a0*=0x397, lpOverlapped=0x0) returned 1 [0079.561] CloseHandle (hObject=0xe4) returned 1 [0079.578] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\block.png", lpFilePart=0x0) returned 0x2a [0079.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.578] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.579] GetFileType (hFile=0xe4) returned 0x1 [0079.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.579] GetFileType (hFile=0xe4) returned 0x1 [0079.579] WriteFile (in: hFile=0xe4, lpBuffer=0x28401a0*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x28401a0*, lpNumberOfBytesWritten=0x8fe764*=0x3a0, lpOverlapped=0x0) returned 1 [0079.582] CloseHandle (hObject=0xe4) returned 1 [0079.583] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\block.png", lpFilePart=0x0) returned 0x2a [0079.583] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\block.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x55 [0079.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.583] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b4fa7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b4fa7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b7d6e45, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3a0)) returned 1 [0079.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.583] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.584] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png", lpFilePart=0x0) returned 0x2d [0079.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.584] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.585] GetFileType (hFile=0xe4) returned 0x1 [0079.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.585] GetFileType (hFile=0xe4) returned 0x1 [0079.585] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x1ba8 [0079.585] ReadFile (in: hFile=0xe4, lpBuffer=0x28414c4, nNumberOfBytesToRead=0x1ba8, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28414c4*, lpNumberOfBytesRead=0x8fe7a0*=0x1ba8, lpOverlapped=0x0) returned 1 [0079.586] CloseHandle (hObject=0xe4) returned 1 [0079.616] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png", lpFilePart=0x0) returned 0x2d [0079.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.617] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.618] GetFileType (hFile=0xe4) returned 0x1 [0079.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.618] GetFileType (hFile=0xe4) returned 0x1 [0079.618] WriteFile (in: hFile=0xe4, lpBuffer=0x2896d34*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2896d34*, lpNumberOfBytesWritten=0x8fe790*=0x1bb0, lpOverlapped=0x0) returned 1 [0079.618] CloseHandle (hObject=0xe4) returned 1 [0079.619] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png", lpFilePart=0x0) returned 0x2d [0079.619] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x58 [0079.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.619] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b8a24, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b8a24, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b823429, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1bb0)) returned 1 [0079.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.619] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.622] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\bullet.png", lpFilePart=0x0) returned 0x2b [0079.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.622] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.622] GetFileType (hFile=0xe4) returned 0x1 [0079.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.622] GetFileType (hFile=0xe4) returned 0x1 [0079.622] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xdd [0079.622] ReadFile (in: hFile=0xe4, lpBuffer=0x2898dec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2898dec*, lpNumberOfBytesRead=0x8fe7a0*=0xdd, lpOverlapped=0x0) returned 1 [0079.623] CloseHandle (hObject=0xe4) returned 1 [0079.638] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\bullet.png", lpFilePart=0x0) returned 0x2b [0079.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.638] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.639] GetFileType (hFile=0xe4) returned 0x1 [0079.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.639] GetFileType (hFile=0xe4) returned 0x1 [0079.639] WriteFile (in: hFile=0xe4, lpBuffer=0x28e6fc4*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x28e6fc4*, lpNumberOfBytesWritten=0x8fe764*=0xe0, lpOverlapped=0x0) returned 1 [0079.641] CloseHandle (hObject=0xe4) returned 1 [0079.641] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\bullet.png", lpFilePart=0x0) returned 0x2b [0079.641] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x56 [0079.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.642] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b9dbd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b9dbd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b84955a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1 [0079.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.642] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.642] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\default.htm", lpFilePart=0x0) returned 0x2c [0079.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.643] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.643] GetFileType (hFile=0xe4) returned 0x1 [0079.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.643] GetFileType (hFile=0xe4) returned 0x1 [0079.643] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xf44d [0079.643] ReadFile (in: hFile=0xe4, lpBuffer=0x28e8304, nNumberOfBytesToRead=0xf44d, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28e8304*, lpNumberOfBytesRead=0x8fe7a0*=0xf44d, lpOverlapped=0x0) returned 1 [0079.658] CloseHandle (hObject=0xe4) returned 1 [0079.696] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\default.htm", lpFilePart=0x0) returned 0x2c [0079.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.696] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.697] GetFileType (hFile=0xe4) returned 0x1 [0079.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.698] GetFileType (hFile=0xe4) returned 0x1 [0079.698] WriteFile (in: hFile=0xe4, lpBuffer=0x2766220*, nNumberOfBytesToWrite=0xf450, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x2766220*, lpNumberOfBytesWritten=0x8fe790*=0xf450, lpOverlapped=0x0) returned 1 [0079.699] CloseHandle (hObject=0xe4) returned 1 [0079.700] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\default.htm", lpFilePart=0x0) returned 0x2c [0079.701] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\default.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0079.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.701] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bc4cd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bc4cd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b8e1f22, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf450)) returned 1 [0079.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.701] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.701] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm", lpFilePart=0x0) returned 0x30 [0079.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.701] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.723] GetFileType (hFile=0xe4) returned 0x1 [0079.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.725] GetFileType (hFile=0xe4) returned 0x1 [0079.725] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xda3a [0079.725] ReadFile (in: hFile=0xe4, lpBuffer=0x2775aac, nNumberOfBytesToRead=0xda3a, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2775aac*, lpNumberOfBytesRead=0x8fe7a0*=0xda3a, lpOverlapped=0x0) returned 1 [0079.726] CloseHandle (hObject=0xe4) returned 1 [0079.743] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm", lpFilePart=0x0) returned 0x30 [0079.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.743] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.744] GetFileType (hFile=0xe4) returned 0x1 [0079.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.744] GetFileType (hFile=0xe4) returned 0x1 [0079.744] WriteFile (in: hFile=0xe4, lpBuffer=0x27eb8e0*, nNumberOfBytesToWrite=0xda40, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27eb8e0*, lpNumberOfBytesWritten=0x8fe790*=0xda40, lpOverlapped=0x0) returned 1 [0079.745] CloseHandle (hObject=0xe4) returned 1 [0079.747] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm", lpFilePart=0x0) returned 0x30 [0079.747] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5b [0079.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.747] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bff6c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bff6c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b9546a4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xda40)) returned 1 [0079.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.747] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.748] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", lpFilePart=0x0) returned 0x31 [0079.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.748] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.748] GetFileType (hFile=0xe4) returned 0x1 [0079.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.748] GetFileType (hFile=0xe4) returned 0x1 [0079.748] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x100ae [0079.748] ReadFile (in: hFile=0xe4, lpBuffer=0x27f9788, nNumberOfBytesToRead=0x100ae, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27f9788*, lpNumberOfBytesRead=0x8fe7a0*=0x100ae, lpOverlapped=0x0) returned 1 [0079.750] CloseHandle (hObject=0xe4) returned 1 [0079.781] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", lpFilePart=0x0) returned 0x31 [0079.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.781] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.783] GetFileType (hFile=0xe4) returned 0x1 [0079.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.783] GetFileType (hFile=0xe4) returned 0x1 [0079.783] WriteFile (in: hFile=0xe4, lpBuffer=0x28767b0*, nNumberOfBytesToWrite=0x100b0, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x28767b0*, lpNumberOfBytesWritten=0x8fe790*=0x100b0, lpOverlapped=0x0) returned 1 [0079.785] CloseHandle (hObject=0xe4) returned 1 [0079.787] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", lpFilePart=0x0) returned 0x31 [0079.787] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5c [0079.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.787] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c2685, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c2685, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b9c6e2b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x100b0)) returned 1 [0079.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.787] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.788] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png", lpFilePart=0x0) returned 0x2f [0079.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.788] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.788] GetFileType (hFile=0xe4) returned 0x1 [0079.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.788] GetFileType (hFile=0xe4) returned 0x1 [0079.789] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xef0 [0079.789] ReadFile (in: hFile=0xe4, lpBuffer=0x2887bc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2887bc8*, lpNumberOfBytesRead=0x8fe7a0*=0xef0, lpOverlapped=0x0) returned 1 [0079.790] CloseHandle (hObject=0xe4) returned 1 [0079.805] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png", lpFilePart=0x0) returned 0x2f [0079.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.805] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.806] GetFileType (hFile=0xe4) returned 0x1 [0079.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.806] GetFileType (hFile=0xe4) returned 0x1 [0079.806] WriteFile (in: hFile=0xe4, lpBuffer=0x28da5d8*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x28da5d8*, lpNumberOfBytesWritten=0x8fe764*=0xf00, lpOverlapped=0x0) returned 1 [0079.807] CloseHandle (hObject=0xe4) returned 1 [0079.807] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png", lpFilePart=0x0) returned 0x2f [0079.807] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5a [0079.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.808] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b9ecf60, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf00)) returned 1 [0079.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.808] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.808] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", lpFilePart=0x0) returned 0x38 [0079.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.808] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.808] GetFileType (hFile=0xe4) returned 0x1 [0079.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.808] GetFileType (hFile=0xe4) returned 0x1 [0079.809] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xfe3 [0079.809] ReadFile (in: hFile=0xe4, lpBuffer=0x28dc938, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28dc938*, lpNumberOfBytesRead=0x8fe7a0*=0xfe3, lpOverlapped=0x0) returned 1 [0079.810] CloseHandle (hObject=0xe4) returned 1 [0079.870] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", lpFilePart=0x0) returned 0x38 [0079.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.870] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.871] GetFileType (hFile=0xe4) returned 0x1 [0079.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.871] GetFileType (hFile=0xe4) returned 0x1 [0079.871] WriteFile (in: hFile=0xe4, lpBuffer=0x2730bf4*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x2730bf4*, lpNumberOfBytesWritten=0x8fe764*=0xff0, lpOverlapped=0x0) returned 1 [0079.872] CloseHandle (hObject=0xe4) returned 1 [0079.873] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", lpFilePart=0x0) returned 0x38 [0079.873] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x63 [0079.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.873] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8ba858e3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xff0)) returned 1 [0079.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.873] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.873] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\loading.gif", lpFilePart=0x0) returned 0x2c [0079.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.873] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.874] GetFileType (hFile=0xe4) returned 0x1 [0079.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.874] GetFileType (hFile=0xe4) returned 0x1 [0079.874] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x43f3 [0079.874] ReadFile (in: hFile=0xe4, lpBuffer=0x2731f68, nNumberOfBytesToRead=0x43f3, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2731f68*, lpNumberOfBytesRead=0x8fe7a0*=0x43f3, lpOverlapped=0x0) returned 1 [0079.880] CloseHandle (hObject=0xe4) returned 1 [0079.898] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\loading.gif", lpFilePart=0x0) returned 0x2c [0079.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.898] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.899] GetFileType (hFile=0xe4) returned 0x1 [0079.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.899] GetFileType (hFile=0xe4) returned 0x1 [0079.899] WriteFile (in: hFile=0xe4, lpBuffer=0x27942c8*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x8fe790, lpOverlapped=0x0 | out: lpBuffer=0x27942c8*, lpNumberOfBytesWritten=0x8fe790*=0x4400, lpOverlapped=0x0) returned 1 [0079.900] CloseHandle (hObject=0xe4) returned 1 [0079.901] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\loading.gif", lpFilePart=0x0) returned 0x2c [0079.901] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x57 [0079.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.901] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bad1e13, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4400)) returned 1 [0079.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.901] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.902] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\lock.png", lpFilePart=0x0) returned 0x29 [0079.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.902] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.903] GetFileType (hFile=0xe4) returned 0x1 [0079.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.903] GetFileType (hFile=0xe4) returned 0x1 [0079.904] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xe5d [0079.904] ReadFile (in: hFile=0xe4, lpBuffer=0x279993c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x279993c*, lpNumberOfBytesRead=0x8fe7a0*=0xe5d, lpOverlapped=0x0) returned 1 [0079.905] CloseHandle (hObject=0xe4) returned 1 [0079.920] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\lock.png", lpFilePart=0x0) returned 0x29 [0079.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.920] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.921] GetFileType (hFile=0xe4) returned 0x1 [0079.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.921] GetFileType (hFile=0xe4) returned 0x1 [0079.921] WriteFile (in: hFile=0xe4, lpBuffer=0x27ec008*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x27ec008*, lpNumberOfBytesWritten=0x8fe764*=0xe60, lpOverlapped=0x0) returned 1 [0079.922] CloseHandle (hObject=0xe4) returned 1 [0079.926] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\lock.png", lpFilePart=0x0) returned 0x29 [0079.926] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\lock.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x54 [0079.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.926] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bb1ed70, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe60)) returned 1 [0079.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.927] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.927] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\logo.png", lpFilePart=0x0) returned 0x29 [0079.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.927] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.927] GetFileType (hFile=0xe4) returned 0x1 [0079.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.927] GetFileType (hFile=0xe4) returned 0x1 [0079.927] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0xa33 [0079.927] ReadFile (in: hFile=0xe4, lpBuffer=0x27edd58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27edd58*, lpNumberOfBytesRead=0x8fe7a0*=0xa33, lpOverlapped=0x0) returned 1 [0079.929] CloseHandle (hObject=0xe4) returned 1 [0079.945] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\logo.png", lpFilePart=0x0) returned 0x29 [0079.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.945] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.946] GetFileType (hFile=0xe4) returned 0x1 [0079.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.946] GetFileType (hFile=0xe4) returned 0x1 [0079.946] WriteFile (in: hFile=0xe4, lpBuffer=0x283ef90*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x283ef90*, lpNumberOfBytesWritten=0x8fe764*=0xa40, lpOverlapped=0x0) returned 1 [0079.946] CloseHandle (hObject=0xe4) returned 1 [0079.947] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\logo.png", lpFilePart=0x0) returned 0x29 [0079.947] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\logo.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x54 [0079.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.947] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bb44491, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa40)) returned 1 [0079.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.947] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.948] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\marketing.png", lpFilePart=0x0) returned 0x2e [0079.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.948] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.948] GetFileType (hFile=0xe4) returned 0x1 [0079.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.948] GetFileType (hFile=0xe4) returned 0x1 [0079.948] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x1ed [0079.948] ReadFile (in: hFile=0xe4, lpBuffer=0x28404b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28404b0*, lpNumberOfBytesRead=0x8fe7a0*=0x1ed, lpOverlapped=0x0) returned 1 [0079.949] CloseHandle (hObject=0xe4) returned 1 [0079.967] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\marketing.png", lpFilePart=0x0) returned 0x2e [0079.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.967] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.968] GetFileType (hFile=0xe4) returned 0x1 [0079.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.968] GetFileType (hFile=0xe4) returned 0x1 [0079.968] WriteFile (in: hFile=0xe4, lpBuffer=0x288ed60*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x288ed60*, lpNumberOfBytesWritten=0x8fe764*=0x1f0, lpOverlapped=0x0) returned 1 [0079.969] CloseHandle (hObject=0xe4) returned 1 [0079.976] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\marketing.png", lpFilePart=0x0) returned 0x2e [0079.976] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x59 [0079.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.976] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bb90df4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1 [0079.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.976] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.977] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", lpFilePart=0x0) returned 0x38 [0079.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.977] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.978] GetFileType (hFile=0xe4) returned 0x1 [0079.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.978] GetFileType (hFile=0xe4) returned 0x1 [0079.979] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x875 [0079.979] ReadFile (in: hFile=0xe4, lpBuffer=0x2890964, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x2890964*, lpNumberOfBytesRead=0x8fe7a0*=0x875, lpOverlapped=0x0) returned 1 [0079.980] CloseHandle (hObject=0xe4) returned 1 [0079.995] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", lpFilePart=0x0) returned 0x38 [0079.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0079.995] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.996] GetFileType (hFile=0xe4) returned 0x1 [0079.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0079.996] GetFileType (hFile=0xe4) returned 0x1 [0079.996] WriteFile (in: hFile=0xe4, lpBuffer=0x28e1314*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x28e1314*, lpNumberOfBytesWritten=0x8fe764*=0x880, lpOverlapped=0x0) returned 1 [0079.997] CloseHandle (hObject=0xe4) returned 1 [0079.997] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", lpFilePart=0x0) returned 0x38 [0079.998] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x63 [0079.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0079.998] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bbb6c1f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x880)) returned 1 [0079.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0079.998] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0079.998] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", lpFilePart=0x0) returned 0x41 [0079.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0079.998] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0079.999] GetFileType (hFile=0xe4) returned 0x1 [0079.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0079.999] GetFileType (hFile=0xe4) returned 0x1 [0079.999] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x8a4 [0079.999] ReadFile (in: hFile=0xe4, lpBuffer=0x28e2f8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x28e2f8c*, lpNumberOfBytesRead=0x8fe7a0*=0x8a4, lpOverlapped=0x0) returned 1 [0080.001] CloseHandle (hObject=0xe4) returned 1 [0080.023] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", lpFilePart=0x0) returned 0x41 [0080.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0080.023] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.024] GetFileType (hFile=0xe4) returned 0x1 [0080.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0080.024] GetFileType (hFile=0xe4) returned 0x1 [0080.024] WriteFile (in: hFile=0xe4, lpBuffer=0x2736720*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x2736720*, lpNumberOfBytesWritten=0x8fe764*=0x8b0, lpOverlapped=0x0) returned 1 [0080.025] CloseHandle (hObject=0xe4) returned 1 [0080.025] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", lpFilePart=0x0) returned 0x41 [0080.025] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x6c [0080.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0080.026] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bc03173, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8b0)) returned 1 [0080.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0080.026] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.026] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png", nBufferLength=0x105, lpBuffer=0x8fe1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\pass.png", lpFilePart=0x0) returned 0x29 [0080.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f8) returned 1 [0080.026] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.026] GetFileType (hFile=0xe4) returned 0x1 [0080.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6f4) returned 1 [0080.026] GetFileType (hFile=0xe4) returned 0x1 [0080.026] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7f4 | out: lpFileSizeHigh=0x8fe7f4*=0x0) returned 0x71e [0080.027] ReadFile (in: hFile=0xe4, lpBuffer=0x27381ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe7a0, lpOverlapped=0x0 | out: lpBuffer=0x27381ec*, lpNumberOfBytesRead=0x8fe7a0*=0x71e, lpOverlapped=0x0) returned 1 [0080.028] CloseHandle (hObject=0xe4) returned 1 [0080.044] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png", nBufferLength=0x105, lpBuffer=0x8fe19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\pass.png", lpFilePart=0x0) returned 0x29 [0080.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6e0) returned 1 [0080.044] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.044] GetFileType (hFile=0xe4) returned 0x1 [0080.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6dc) returned 1 [0080.045] GetFileType (hFile=0xe4) returned 0x1 [0080.045] WriteFile (in: hFile=0xe4, lpBuffer=0x27885d4*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x8fe764, lpOverlapped=0x0 | out: lpBuffer=0x27885d4*, lpNumberOfBytesWritten=0x8fe764*=0x720, lpOverlapped=0x0) returned 1 [0080.045] CloseHandle (hObject=0xe4) returned 1 [0080.052] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\pass.png", lpFilePart=0x0) returned 0x29 [0080.053] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\pass.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x54 [0080.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe778) returned 1 [0080.053] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), fInfoLevelId=0x0, lpFileInformation=0x8fe7f4 | out: lpFileInformation=0x8fe7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bc2aa11, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x720)) returned 1 [0080.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0080.053] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f0) returned 1 [0080.053] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux", nBufferLength=0x105, lpBuffer=0x8fe2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux", lpFilePart=0x0) returned 0x20 [0080.053] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\*", lpFindFileData=0x8fe518 | out: lpFindFileData=0x8fe518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8bc4f637, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8bc4f637, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f08 [0080.054] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8bc4f637, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8bc4f637, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.054] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b4fa7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b4fa7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b7d6e45, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="block.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="BLOCKP~1.MAD")) returned 1 [0080.054] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b8a24, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b8a24, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b823429, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bluelogo.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="BLUELO~1.MAD")) returned 1 [0080.054] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b9dbd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b9dbd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b84955a, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bullet.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="BULLET~1.MAD")) returned 1 [0080.054] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bb141, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bb141, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.css", cAlternateFileName="")) returned 1 [0080.054] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bc4cd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bc4cd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b8e1f22, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf450, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="DEFAUL~1.MAD")) returned 1 [0080.054] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bd859, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bd859, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x13e24500, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_eos.css", cAlternateFileName="DEFAUL~1.CSS")) returned 1 [0080.054] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bff6c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bff6c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b9546a4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xda40, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_eos.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="DEFAUL~2.MAD")) returned 1 [0080.054] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c12fc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c12fc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1468, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_oobe.css", cAlternateFileName="DEFAUL~2.CSS")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c2685, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c2685, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b9c6e2b, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x100b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_oobe.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="DEFAUL~3.MAD")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA", cAlternateFileName="")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.css", cAlternateFileName="")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b9ecf60, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStarted.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="GETSTA~1.MAD")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8ba858e3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedHoverOver.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="GETSTA~2.MAD")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bad1e13, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="loading.gif.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOADIN~1.MAD")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bb1ed70, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x0, cFileName="lock.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOCKPN~1.MAD")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bb44491, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="LOGOPN~1.MAD")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bb90df4, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="marketing.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="MARKET~1.MAD")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea60a72c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WinJS", cAlternateFileName="MICROS~1.WIN")) returned 1 [0080.056] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea627c0d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea627c0d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x97e0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkIssueFAQ.mht", cAlternateFileName="NETWOR~1.MHT")) returned 1 [0080.056] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bbb6c1f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x880, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoNetworkConnection.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="NONETW~1.MAD")) returned 1 [0080.056] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bc03173, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x8b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoNetworkConnectionHoverOver.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="NONETW~2.MAD")) returned 1 [0080.056] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bc2aa11, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x720, dwReserved0=0x0, dwReserved1=0x0, cFileName="pass.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="PASSPN~1.MAD")) returned 1 [0080.056] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe524 | out: lpFindFileData=0x8fe524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bc2aa11, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x720, dwReserved0=0x0, dwReserved1=0x0, cFileName="pass.png.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="PASSPN~1.MAD")) returned 0 [0080.056] FindClose (in: hFindFile=0xac0f08 | out: hFindFile=0xac0f08) returned 1 [0080.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7ac) returned 1 [0080.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7b8) returned 1 [0080.056] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA", lpFilePart=0x0) returned 0x25 [0080.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0080.056] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA", lpFilePart=0x0) returned 0x25 [0080.056] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1248 [0080.059] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.063] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c6124, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c6124, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1af6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ar-sa.htm", cAlternateFileName="EULA_A~1.HTM")) returned 1 [0080.063] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c74ab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c74ab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3de0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_bg-bg.htm", cAlternateFileName="EULA_B~1.HTM")) returned 1 [0080.063] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c882e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c882e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14573, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_cs-cz.htm", cAlternateFileName="EULA_C~1.HTM")) returned 1 [0080.063] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3caf18, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3caf18, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe95, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_da-dk.htm", cAlternateFileName="EULA_D~1.HTM")) returned 1 [0080.063] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d10e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d10e9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1133d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_de-de.htm", cAlternateFileName="EULA_D~2.HTM")) returned 1 [0080.063] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d2466, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d2466, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3a756, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_el-gr.htm", cAlternateFileName="EULA_E~1.HTM")) returned 1 [0080.063] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d5f05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d5f05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_en-gb.htm", cAlternateFileName="EULA_E~2.HTM")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d997f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d997f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_en-us.htm", cAlternateFileName="EULA_E~3.HTM")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dad37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dad37, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_es-es.htm", cAlternateFileName="EULA_E~4.HTM")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dc0bd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dc0bd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_es-mx.htm", cAlternateFileName="EU6344~1.HTM")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dd45a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dd45a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf67d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_et-ee.htm", cAlternateFileName="EU56AC~1.HTM")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dfb2b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dfb2b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1145a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_fi-fi.htm", cAlternateFileName="EULA_F~1.HTM")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e0ee6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e0ee6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_fr-ca.htm", cAlternateFileName="EULA_F~2.HTM")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e2266, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e2266, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_fr-fr.htm", cAlternateFileName="EULA_F~3.HTM")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e35dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e35dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xd3187, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_he-il.htm", cAlternateFileName="EULA_H~1.HTM")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e977f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e977f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_hr-hr.htm", cAlternateFileName="EULA_H~2.HTM")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ebeab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ebeab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_hu-hu.htm", cAlternateFileName="EULA_H~3.HTM")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ed234, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ed234, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_it-it.htm", cAlternateFileName="EULA_I~1.HTM")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ef94a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ef94a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3354e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ja-jp.htm", cAlternateFileName="EULA_J~1.HTM")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f205a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f205a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ace3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ko-kr.htm", cAlternateFileName="EULA_K~1.HTM")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f33e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f33e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1293b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_lt-lt.htm", cAlternateFileName="EULA_L~1.HTM")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f5af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f5af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x147c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_lv-lv.htm", cAlternateFileName="EULA_L~2.HTM")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fa921, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fa921, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10674, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_nb-no.htm", cAlternateFileName="EULA_N~1.HTM")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fe3b1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fe3b1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10698, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_nl-nl.htm", cAlternateFileName="EULA_N~2.HTM")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ff747, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ff747, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13f94, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_pl-pl.htm", cAlternateFileName="EULA_P~1.HTM")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea400ac7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea400ac7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10ac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_pt-br.htm", cAlternateFileName="EULA_P~2.HTM")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea401e7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea401e7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1158e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_pt-pt.htm", cAlternateFileName="EULA_P~3.HTM")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5c6190, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5c6190, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ro-ro.htm", cAlternateFileName="EULA_R~1.HTM")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x454cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ru-ru.htm", cAlternateFileName="EULA_R~2.HTM")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14021, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sk-sk.htm", cAlternateFileName="EULA_S~1.HTM")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1026f, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sl-si.htm", cAlternateFileName="EULA_S~2.HTM")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12720, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sr-latn-cs.htm", cAlternateFileName="EULA_S~3.HTM")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x112f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sv-se.htm", cAlternateFileName="EULA_S~4.HTM")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3e0c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_th-th.htm", cAlternateFileName="EULA_T~1.HTM")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12581, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_tr-tr.htm", cAlternateFileName="EULA_T~2.HTM")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x411eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_uk-ua.htm", cAlternateFileName="EULA_U~1.HTM")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed21, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-cn.htm", cAlternateFileName="EULA_Z~1.HTM")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-hk.htm", cAlternateFileName="EULA_Z~2.HTM")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-tw.htm", cAlternateFileName="EULA_Z~3.HTM")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0xac1248, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.066] FindClose (in: hFindFile=0xac1248 | out: hFindFile=0xac1248) returned 1 [0080.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0080.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0080.067] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", lpFilePart=0x0) returned 0x34 [0080.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.067] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.068] GetFileType (hFile=0xe4) returned 0x1 [0080.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.068] GetFileType (hFile=0xe4) returned 0x1 [0080.068] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x1af6d [0080.068] ReadFile (in: hFile=0xe4, lpBuffer=0x3857050, nNumberOfBytesToRead=0x1af6d, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x3857050*, lpNumberOfBytesRead=0x8fe75c*=0x1af6d, lpOverlapped=0x0) returned 1 [0080.075] CloseHandle (hObject=0xe4) returned 1 [0080.137] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", lpFilePart=0x0) returned 0x34 [0080.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.137] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.138] GetFileType (hFile=0xe4) returned 0x1 [0080.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.139] GetFileType (hFile=0xe4) returned 0x1 [0080.139] WriteFile (in: hFile=0xe4, lpBuffer=0x38dddc0*, nNumberOfBytesToWrite=0x1af70, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x38dddc0*, lpNumberOfBytesWritten=0x8fe74c*=0x1af70, lpOverlapped=0x0) returned 1 [0080.140] CloseHandle (hObject=0xe4) returned 1 [0080.143] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", lpFilePart=0x0) returned 0x34 [0080.143] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.143] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c6124, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c6124, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bd344a3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1af70)) returned 1 [0080.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.144] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.144] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", lpFilePart=0x0) returned 0x34 [0080.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.145] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.145] GetFileType (hFile=0xe4) returned 0x1 [0080.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.145] GetFileType (hFile=0xe4) returned 0x1 [0080.145] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x3de0d [0080.145] ReadFile (in: hFile=0xe4, lpBuffer=0x38f8d50, nNumberOfBytesToRead=0x3de0d, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x38f8d50*, lpNumberOfBytesRead=0x8fe75c*=0x3de0d, lpOverlapped=0x0) returned 1 [0080.151] CloseHandle (hObject=0xe4) returned 1 [0080.218] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", lpFilePart=0x0) returned 0x34 [0080.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.218] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.221] GetFileType (hFile=0xe4) returned 0x1 [0080.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.221] GetFileType (hFile=0xe4) returned 0x1 [0080.221] WriteFile (in: hFile=0xe4, lpBuffer=0x36c98e8*, nNumberOfBytesToWrite=0x3de10, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x36c98e8*, lpNumberOfBytesWritten=0x8fe74c*=0x3de10, lpOverlapped=0x0) returned 1 [0080.224] CloseHandle (hObject=0xe4) returned 1 [0080.228] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", lpFilePart=0x0) returned 0x34 [0080.228] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.228] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c74ab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c74ab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bdf2f97, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3de10)) returned 1 [0080.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.229] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.229] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", lpFilePart=0x0) returned 0x34 [0080.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.230] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.230] GetFileType (hFile=0xe4) returned 0x1 [0080.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.230] GetFileType (hFile=0xe4) returned 0x1 [0080.230] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x14573 [0080.230] ReadFile (in: hFile=0xe4, lpBuffer=0x270057c, nNumberOfBytesToRead=0x14573, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x270057c*, lpNumberOfBytesRead=0x8fe75c*=0x14573, lpOverlapped=0x0) returned 1 [0080.232] CloseHandle (hObject=0xe4) returned 1 [0080.281] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", lpFilePart=0x0) returned 0x34 [0080.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.281] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.283] GetFileType (hFile=0xe4) returned 0x1 [0080.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.283] GetFileType (hFile=0xe4) returned 0x1 [0080.283] WriteFile (in: hFile=0xe4, lpBuffer=0x27a679c*, nNumberOfBytesToWrite=0x14580, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27a679c*, lpNumberOfBytesWritten=0x8fe74c*=0x14580, lpOverlapped=0x0) returned 1 [0080.284] CloseHandle (hObject=0xe4) returned 1 [0080.286] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", lpFilePart=0x0) returned 0x34 [0080.286] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.286] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c882e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c882e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8be8b940, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x14580)) returned 1 [0080.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.286] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.287] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", lpFilePart=0x0) returned 0x34 [0080.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.287] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.287] GetFileType (hFile=0xe4) returned 0x1 [0080.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.288] GetFileType (hFile=0xe4) returned 0x1 [0080.288] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xfe95 [0080.288] ReadFile (in: hFile=0xe4, lpBuffer=0x27bb190, nNumberOfBytesToRead=0xfe95, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x27bb190*, lpNumberOfBytesRead=0x8fe75c*=0xfe95, lpOverlapped=0x0) returned 1 [0080.292] CloseHandle (hObject=0xe4) returned 1 [0080.329] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", lpFilePart=0x0) returned 0x34 [0080.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.329] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.331] GetFileType (hFile=0xe4) returned 0x1 [0080.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.331] GetFileType (hFile=0xe4) returned 0x1 [0080.331] WriteFile (in: hFile=0xe4, lpBuffer=0x274881c*, nNumberOfBytesToWrite=0xfea0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x274881c*, lpNumberOfBytesWritten=0x8fe74c*=0xfea0, lpOverlapped=0x0) returned 1 [0080.332] CloseHandle (hObject=0xe4) returned 1 [0080.334] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", lpFilePart=0x0) returned 0x34 [0080.334] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.334] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3caf18, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3caf18, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8befe0e9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfea0)) returned 1 [0080.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.334] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.334] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", lpFilePart=0x0) returned 0x34 [0080.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.334] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.335] GetFileType (hFile=0xe4) returned 0x1 [0080.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.335] GetFileType (hFile=0xe4) returned 0x1 [0080.335] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x1133d [0080.335] ReadFile (in: hFile=0xe4, lpBuffer=0x2758b30, nNumberOfBytesToRead=0x1133d, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2758b30*, lpNumberOfBytesRead=0x8fe75c*=0x1133d, lpOverlapped=0x0) returned 1 [0080.337] CloseHandle (hObject=0xe4) returned 1 [0080.355] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", lpFilePart=0x0) returned 0x34 [0080.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.355] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.356] GetFileType (hFile=0xe4) returned 0x1 [0080.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.356] GetFileType (hFile=0xe4) returned 0x1 [0080.356] WriteFile (in: hFile=0xe4, lpBuffer=0x27d9464*, nNumberOfBytesToWrite=0x11340, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27d9464*, lpNumberOfBytesWritten=0x8fe74c*=0x11340, lpOverlapped=0x0) returned 1 [0080.357] CloseHandle (hObject=0xe4) returned 1 [0080.360] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", lpFilePart=0x0) returned 0x34 [0080.360] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.360] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d10e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d10e9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bf24206, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11340)) returned 1 [0080.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.360] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.363] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", lpFilePart=0x0) returned 0x34 [0080.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.363] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.363] GetFileType (hFile=0xe4) returned 0x1 [0080.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.363] GetFileType (hFile=0xe4) returned 0x1 [0080.363] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x3a756 [0080.364] ReadFile (in: hFile=0xe4, lpBuffer=0x37725d8, nNumberOfBytesToRead=0x3a756, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x37725d8*, lpNumberOfBytesRead=0x8fe75c*=0x3a756, lpOverlapped=0x0) returned 1 [0080.367] CloseHandle (hObject=0xe4) returned 1 [0080.390] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", lpFilePart=0x0) returned 0x34 [0080.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.390] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.392] GetFileType (hFile=0xe4) returned 0x1 [0080.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.392] GetFileType (hFile=0xe4) returned 0x1 [0080.392] WriteFile (in: hFile=0xe4, lpBuffer=0x3896af0*, nNumberOfBytesToWrite=0x3a760, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x3896af0*, lpNumberOfBytesWritten=0x8fe74c*=0x3a760, lpOverlapped=0x0) returned 1 [0080.395] CloseHandle (hObject=0xe4) returned 1 [0080.399] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", lpFilePart=0x0) returned 0x34 [0080.399] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.399] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d2466, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d2466, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bf96951, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3a760)) returned 1 [0080.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.399] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.400] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", lpFilePart=0x0) returned 0x34 [0080.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.400] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.400] GetFileType (hFile=0xe4) returned 0x1 [0080.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.400] GetFileType (hFile=0xe4) returned 0x1 [0080.400] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xe4b5 [0080.400] ReadFile (in: hFile=0xe4, lpBuffer=0x2837e9c, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2837e9c*, lpNumberOfBytesRead=0x8fe75c*=0xe4b5, lpOverlapped=0x0) returned 1 [0080.409] CloseHandle (hObject=0xe4) returned 1 [0080.429] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", lpFilePart=0x0) returned 0x34 [0080.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.429] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.430] GetFileType (hFile=0xe4) returned 0x1 [0080.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.430] GetFileType (hFile=0xe4) returned 0x1 [0080.431] WriteFile (in: hFile=0xe4, lpBuffer=0x28afaf4*, nNumberOfBytesToWrite=0xe4c0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28afaf4*, lpNumberOfBytesWritten=0x8fe74c*=0xe4c0, lpOverlapped=0x0) returned 1 [0080.435] CloseHandle (hObject=0xe4) returned 1 [0080.436] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", lpFilePart=0x0) returned 0x34 [0080.437] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.437] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d5f05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d5f05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bfe7e21, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe4c0)) returned 1 [0080.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.437] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.437] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", lpFilePart=0x0) returned 0x34 [0080.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.438] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.438] GetFileType (hFile=0xe4) returned 0x1 [0080.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.438] GetFileType (hFile=0xe4) returned 0x1 [0080.438] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xe4b5 [0080.438] ReadFile (in: hFile=0xe4, lpBuffer=0x28be428, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28be428*, lpNumberOfBytesRead=0x8fe75c*=0xe4b5, lpOverlapped=0x0) returned 1 [0080.439] CloseHandle (hObject=0xe4) returned 1 [0080.471] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", lpFilePart=0x0) returned 0x34 [0080.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.471] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.472] GetFileType (hFile=0xe4) returned 0x1 [0080.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.473] GetFileType (hFile=0xe4) returned 0x1 [0080.473] WriteFile (in: hFile=0xe4, lpBuffer=0x2734720*, nNumberOfBytesToWrite=0xe4c0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2734720*, lpNumberOfBytesWritten=0x8fe74c*=0xe4c0, lpOverlapped=0x0) returned 1 [0080.474] CloseHandle (hObject=0xe4) returned 1 [0080.475] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", lpFilePart=0x0) returned 0x34 [0080.475] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.475] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d997f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d997f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c055501, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe4c0)) returned 1 [0080.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.475] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.476] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", lpFilePart=0x0) returned 0x34 [0080.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.476] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.476] GetFileType (hFile=0xe4) returned 0x1 [0080.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.476] GetFileType (hFile=0xe4) returned 0x1 [0080.476] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x110b8 [0080.476] ReadFile (in: hFile=0xe4, lpBuffer=0x2743054, nNumberOfBytesToRead=0x110b8, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2743054*, lpNumberOfBytesRead=0x8fe75c*=0x110b8, lpOverlapped=0x0) returned 1 [0080.490] CloseHandle (hObject=0xe4) returned 1 [0080.510] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", lpFilePart=0x0) returned 0x34 [0080.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.510] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.511] GetFileType (hFile=0xe4) returned 0x1 [0080.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.511] GetFileType (hFile=0xe4) returned 0x1 [0080.511] WriteFile (in: hFile=0xe4, lpBuffer=0x27c3204*, nNumberOfBytesToWrite=0x110c0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27c3204*, lpNumberOfBytesWritten=0x8fe74c*=0x110c0, lpOverlapped=0x0) returned 1 [0080.513] CloseHandle (hObject=0xe4) returned 1 [0080.515] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", lpFilePart=0x0) returned 0x34 [0080.515] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.515] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dad37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dad37, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c0a1963, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x110c0)) returned 1 [0080.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.515] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.516] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", lpFilePart=0x0) returned 0x34 [0080.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.516] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.516] GetFileType (hFile=0xe4) returned 0x1 [0080.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.516] GetFileType (hFile=0xe4) returned 0x1 [0080.516] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x110b8 [0080.516] ReadFile (in: hFile=0xe4, lpBuffer=0x27d4738, nNumberOfBytesToRead=0x110b8, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x27d4738*, lpNumberOfBytesRead=0x8fe75c*=0x110b8, lpOverlapped=0x0) returned 1 [0080.533] CloseHandle (hObject=0xe4) returned 1 [0080.551] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", lpFilePart=0x0) returned 0x34 [0080.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.551] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.552] GetFileType (hFile=0xe4) returned 0x1 [0080.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.552] GetFileType (hFile=0xe4) returned 0x1 [0080.552] WriteFile (in: hFile=0xe4, lpBuffer=0x285478c*, nNumberOfBytesToWrite=0x110c0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x285478c*, lpNumberOfBytesWritten=0x8fe74c*=0x110c0, lpOverlapped=0x0) returned 1 [0080.554] CloseHandle (hObject=0xe4) returned 1 [0080.555] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", lpFilePart=0x0) returned 0x34 [0080.555] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.556] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dc0bd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dc0bd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c114069, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x110c0)) returned 1 [0080.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.556] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.556] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", lpFilePart=0x0) returned 0x34 [0080.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.556] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.556] GetFileType (hFile=0xe4) returned 0x1 [0080.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.556] GetFileType (hFile=0xe4) returned 0x1 [0080.557] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xf67d [0080.557] ReadFile (in: hFile=0xe4, lpBuffer=0x2865cc0, nNumberOfBytesToRead=0xf67d, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2865cc0*, lpNumberOfBytesRead=0x8fe75c*=0xf67d, lpOverlapped=0x0) returned 1 [0080.561] CloseHandle (hObject=0xe4) returned 1 [0080.578] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", lpFilePart=0x0) returned 0x34 [0080.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.578] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.593] GetFileType (hFile=0xe4) returned 0x1 [0080.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.593] GetFileType (hFile=0xe4) returned 0x1 [0080.593] WriteFile (in: hFile=0xe4, lpBuffer=0x28e0e58*, nNumberOfBytesToWrite=0xf680, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28e0e58*, lpNumberOfBytesWritten=0x8fe74c*=0xf680, lpOverlapped=0x0) returned 1 [0080.595] CloseHandle (hObject=0xe4) returned 1 [0080.597] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", lpFilePart=0x0) returned 0x34 [0080.597] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.597] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dd45a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dd45a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c1867a6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf680)) returned 1 [0080.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.597] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.598] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", lpFilePart=0x0) returned 0x34 [0080.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.598] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.598] GetFileType (hFile=0xe4) returned 0x1 [0080.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.598] GetFileType (hFile=0xe4) returned 0x1 [0080.598] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x1145a [0080.599] ReadFile (in: hFile=0xe4, lpBuffer=0x28f094c, nNumberOfBytesToRead=0x1145a, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28f094c*, lpNumberOfBytesRead=0x8fe75c*=0x1145a, lpOverlapped=0x0) returned 1 [0080.600] CloseHandle (hObject=0xe4) returned 1 [0080.639] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", lpFilePart=0x0) returned 0x34 [0080.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.639] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.640] GetFileType (hFile=0xe4) returned 0x1 [0080.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.640] GetFileType (hFile=0xe4) returned 0x1 [0080.640] WriteFile (in: hFile=0xe4, lpBuffer=0x277c818*, nNumberOfBytesToWrite=0x11460, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x277c818*, lpNumberOfBytesWritten=0x8fe74c*=0x11460, lpOverlapped=0x0) returned 1 [0080.643] CloseHandle (hObject=0xe4) returned 1 [0080.645] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", lpFilePart=0x0) returned 0x34 [0080.645] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.645] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dfb2b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dfb2b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c1f8ea2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11460)) returned 1 [0080.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.645] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.646] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", lpFilePart=0x0) returned 0x34 [0080.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.646] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.646] GetFileType (hFile=0xe4) returned 0x1 [0080.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.646] GetFileType (hFile=0xe4) returned 0x1 [0080.646] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x10f0a [0080.646] ReadFile (in: hFile=0xe4, lpBuffer=0x278e0ec, nNumberOfBytesToRead=0x10f0a, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x278e0ec*, lpNumberOfBytesRead=0x8fe75c*=0x10f0a, lpOverlapped=0x0) returned 1 [0080.648] CloseHandle (hObject=0xe4) returned 1 [0080.665] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", lpFilePart=0x0) returned 0x34 [0080.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.665] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.666] GetFileType (hFile=0xe4) returned 0x1 [0080.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.666] GetFileType (hFile=0xe4) returned 0x1 [0080.666] WriteFile (in: hFile=0xe4, lpBuffer=0x280dc34*, nNumberOfBytesToWrite=0x10f10, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x280dc34*, lpNumberOfBytesWritten=0x8fe74c*=0x10f10, lpOverlapped=0x0) returned 1 [0080.668] CloseHandle (hObject=0xe4) returned 1 [0080.669] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", lpFilePart=0x0) returned 0x34 [0080.669] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.669] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e0ee6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e0ee6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c21f197, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10f10)) returned 1 [0080.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.670] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.670] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", lpFilePart=0x0) returned 0x34 [0080.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.670] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.671] GetFileType (hFile=0xe4) returned 0x1 [0080.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.671] GetFileType (hFile=0xe4) returned 0x1 [0080.671] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x10f0a [0080.671] ReadFile (in: hFile=0xe4, lpBuffer=0x281efb8, nNumberOfBytesToRead=0x10f0a, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x281efb8*, lpNumberOfBytesRead=0x8fe75c*=0x10f0a, lpOverlapped=0x0) returned 1 [0080.672] CloseHandle (hObject=0xe4) returned 1 [0080.695] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", lpFilePart=0x0) returned 0x34 [0080.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.695] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.696] GetFileType (hFile=0xe4) returned 0x1 [0080.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.696] GetFileType (hFile=0xe4) returned 0x1 [0080.696] WriteFile (in: hFile=0xe4, lpBuffer=0x289eb00*, nNumberOfBytesToWrite=0x10f10, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x289eb00*, lpNumberOfBytesWritten=0x8fe74c*=0x10f10, lpOverlapped=0x0) returned 1 [0080.697] CloseHandle (hObject=0xe4) returned 1 [0080.699] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", lpFilePart=0x0) returned 0x34 [0080.699] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.699] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e2266, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e2266, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c26b55d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10f10)) returned 1 [0080.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.699] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.699] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", lpFilePart=0x0) returned 0x34 [0080.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.699] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.700] GetFileType (hFile=0xe4) returned 0x1 [0080.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.700] GetFileType (hFile=0xe4) returned 0x1 [0080.700] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xd3187 [0080.719] ReadFile (in: hFile=0xe4, lpBuffer=0x36c98e8, nNumberOfBytesToRead=0xd3187, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x36c98e8*, lpNumberOfBytesRead=0x8fe75c*=0xd3187, lpOverlapped=0x0) returned 1 [0080.735] CloseHandle (hObject=0xe4) returned 1 [0080.835] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", lpFilePart=0x0) returned 0x34 [0080.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.835] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.841] GetFileType (hFile=0xe4) returned 0x1 [0080.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.841] GetFileType (hFile=0xe4) returned 0x1 [0080.841] WriteFile (in: hFile=0xe4, lpBuffer=0x36c98e8*, nNumberOfBytesToWrite=0xd3190, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x36c98e8*, lpNumberOfBytesWritten=0x8fe74c*=0xd3190, lpOverlapped=0x0) returned 1 [0080.852] CloseHandle (hObject=0xe4) returned 1 [0080.852] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", lpFilePart=0x0) returned 0x34 [0080.852] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.852] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e35dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e35dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c3e8e15, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd3190)) returned 1 [0080.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.852] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.853] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", lpFilePart=0x0) returned 0x34 [0080.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.853] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.854] GetFileType (hFile=0xe4) returned 0x1 [0080.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.854] GetFileType (hFile=0xe4) returned 0x1 [0080.854] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0xfd68 [0080.854] ReadFile (in: hFile=0xe4, lpBuffer=0x26ed890, nNumberOfBytesToRead=0xfd68, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x26ed890*, lpNumberOfBytesRead=0x8fe75c*=0xfd68, lpOverlapped=0x0) returned 1 [0080.855] CloseHandle (hObject=0xe4) returned 1 [0080.891] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", lpFilePart=0x0) returned 0x34 [0080.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.892] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.893] GetFileType (hFile=0xe4) returned 0x1 [0080.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.893] GetFileType (hFile=0xe4) returned 0x1 [0080.893] WriteFile (in: hFile=0xe4, lpBuffer=0x276a598*, nNumberOfBytesToWrite=0xfd70, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x276a598*, lpNumberOfBytesWritten=0x8fe74c*=0xfd70, lpOverlapped=0x0) returned 1 [0080.894] CloseHandle (hObject=0xe4) returned 1 [0080.894] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", lpFilePart=0x0) returned 0x34 [0080.894] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.894] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e977f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e977f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c45b59d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfd70)) returned 1 [0080.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.894] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.895] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", lpFilePart=0x0) returned 0x34 [0080.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.895] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.895] GetFileType (hFile=0xe4) returned 0x1 [0080.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.895] GetFileType (hFile=0xe4) returned 0x1 [0080.895] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x14a5a [0080.895] ReadFile (in: hFile=0xe4, lpBuffer=0x277a77c, nNumberOfBytesToRead=0x14a5a, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x277a77c*, lpNumberOfBytesRead=0x8fe75c*=0x14a5a, lpOverlapped=0x0) returned 1 [0080.896] CloseHandle (hObject=0xe4) returned 1 [0080.914] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", lpFilePart=0x0) returned 0x34 [0080.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.914] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.915] GetFileType (hFile=0xe4) returned 0x1 [0080.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.915] GetFileType (hFile=0xe4) returned 0x1 [0080.915] WriteFile (in: hFile=0xe4, lpBuffer=0x28054b4*, nNumberOfBytesToWrite=0x14a60, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28054b4*, lpNumberOfBytesWritten=0x8fe74c*=0x14a60, lpOverlapped=0x0) returned 1 [0080.916] CloseHandle (hObject=0xe4) returned 1 [0080.917] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", lpFilePart=0x0) returned 0x34 [0080.917] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.917] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ebeab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ebeab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c481714, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x14a60)) returned 1 [0080.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.917] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.917] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", lpFilePart=0x0) returned 0x34 [0080.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.917] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.917] GetFileType (hFile=0xe4) returned 0x1 [0080.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.917] GetFileType (hFile=0xe4) returned 0x1 [0080.917] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x10f6d [0080.918] ReadFile (in: hFile=0xe4, lpBuffer=0x281a388, nNumberOfBytesToRead=0x10f6d, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x281a388*, lpNumberOfBytesRead=0x8fe75c*=0x10f6d, lpOverlapped=0x0) returned 1 [0080.920] CloseHandle (hObject=0xe4) returned 1 [0080.937] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", lpFilePart=0x0) returned 0x34 [0080.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.937] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.938] GetFileType (hFile=0xe4) returned 0x1 [0080.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.938] GetFileType (hFile=0xe4) returned 0x1 [0080.939] WriteFile (in: hFile=0xe4, lpBuffer=0x2899ff0*, nNumberOfBytesToWrite=0x10f70, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2899ff0*, lpNumberOfBytesWritten=0x8fe74c*=0x10f70, lpOverlapped=0x0) returned 1 [0080.940] CloseHandle (hObject=0xe4) returned 1 [0080.940] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", lpFilePart=0x0) returned 0x34 [0080.940] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.940] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ed234, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ed234, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c4cdc2d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10f70)) returned 1 [0080.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.941] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.941] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", lpFilePart=0x0) returned 0x34 [0080.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.941] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.941] GetFileType (hFile=0xe4) returned 0x1 [0080.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.941] GetFileType (hFile=0xe4) returned 0x1 [0080.941] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x3354e [0080.942] ReadFile (in: hFile=0xe4, lpBuffer=0x3807918, nNumberOfBytesToRead=0x3354e, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x3807918*, lpNumberOfBytesRead=0x8fe75c*=0x3354e, lpOverlapped=0x0) returned 1 [0080.947] CloseHandle (hObject=0xe4) returned 1 [0080.974] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", lpFilePart=0x0) returned 0x34 [0080.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0080.974] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.976] GetFileType (hFile=0xe4) returned 0x1 [0080.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0080.976] GetFileType (hFile=0xe4) returned 0x1 [0080.976] WriteFile (in: hFile=0xe4, lpBuffer=0x39083e8*, nNumberOfBytesToWrite=0x33550, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x39083e8*, lpNumberOfBytesWritten=0x8fe74c*=0x33550, lpOverlapped=0x0) returned 1 [0080.978] CloseHandle (hObject=0xe4) returned 1 [0080.979] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", lpFilePart=0x0) returned 0x34 [0080.979] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0080.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0080.979] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ef94a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ef94a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c51a1a3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x33550)) returned 1 [0080.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0080.979] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0080.979] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", lpFilePart=0x0) returned 0x34 [0080.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0080.979] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0080.980] GetFileType (hFile=0xe4) returned 0x1 [0080.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0080.980] GetFileType (hFile=0xe4) returned 0x1 [0080.980] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x9ace3 [0080.981] ReadFile (in: hFile=0xe4, lpBuffer=0x3ae90f0, nNumberOfBytesToRead=0x9ace3, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x3ae90f0*, lpNumberOfBytesRead=0x8fe75c*=0x9ace3, lpOverlapped=0x0) returned 1 [0080.991] CloseHandle (hObject=0xe4) returned 1 [0081.061] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", lpFilePart=0x0) returned 0x34 [0081.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.061] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.066] GetFileType (hFile=0xe4) returned 0x1 [0081.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.066] GetFileType (hFile=0xe4) returned 0x1 [0081.066] WriteFile (in: hFile=0xe4, lpBuffer=0x3934cc8*, nNumberOfBytesToWrite=0x9acf0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x3934cc8*, lpNumberOfBytesWritten=0x8fe74c*=0x9acf0, lpOverlapped=0x0) returned 1 [0081.077] CloseHandle (hObject=0xe4) returned 1 [0081.077] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", lpFilePart=0x0) returned 0x34 [0081.077] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.077] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f205a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f205a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c5ff006, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9acf0)) returned 1 [0081.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.077] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.078] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", lpFilePart=0x0) returned 0x34 [0081.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.078] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.078] GetFileType (hFile=0xe4) returned 0x1 [0081.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.078] GetFileType (hFile=0xe4) returned 0x1 [0081.078] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x1293b [0081.078] ReadFile (in: hFile=0xe4, lpBuffer=0x26edaf8, nNumberOfBytesToRead=0x1293b, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x26edaf8*, lpNumberOfBytesRead=0x8fe75c*=0x1293b, lpOverlapped=0x0) returned 1 [0081.087] CloseHandle (hObject=0xe4) returned 1 [0081.218] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", lpFilePart=0x0) returned 0x34 [0081.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.218] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.219] GetFileType (hFile=0xe4) returned 0x1 [0081.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.219] GetFileType (hFile=0xe4) returned 0x1 [0081.220] WriteFile (in: hFile=0xe4, lpBuffer=0x2700048*, nNumberOfBytesToWrite=0x12940, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2700048*, lpNumberOfBytesWritten=0x8fe74c*=0x12940, lpOverlapped=0x0) returned 1 [0081.221] CloseHandle (hObject=0xe4) returned 1 [0081.221] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", lpFilePart=0x0) returned 0x34 [0081.221] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.221] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f33e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f33e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c77c62d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12940)) returned 1 [0081.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.221] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.222] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", lpFilePart=0x0) returned 0x34 [0081.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.222] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.222] GetFileType (hFile=0xe4) returned 0x1 [0081.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.222] GetFileType (hFile=0xe4) returned 0x1 [0081.222] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x147c5 [0081.222] ReadFile (in: hFile=0xe4, lpBuffer=0x2712dfc, nNumberOfBytesToRead=0x147c5, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2712dfc*, lpNumberOfBytesRead=0x8fe75c*=0x147c5, lpOverlapped=0x0) returned 1 [0081.224] CloseHandle (hObject=0xe4) returned 1 [0081.303] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", lpFilePart=0x0) returned 0x34 [0081.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.303] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.305] GetFileType (hFile=0xe4) returned 0x1 [0081.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.305] GetFileType (hFile=0xe4) returned 0x1 [0081.305] WriteFile (in: hFile=0xe4, lpBuffer=0x279d4e0*, nNumberOfBytesToWrite=0x147d0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x279d4e0*, lpNumberOfBytesWritten=0x8fe74c*=0x147d0, lpOverlapped=0x0) returned 1 [0081.306] CloseHandle (hObject=0xe4) returned 1 [0081.306] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", lpFilePart=0x0) returned 0x34 [0081.306] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.306] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f5af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f5af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c83b11f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x147d0)) returned 1 [0081.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.306] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.307] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", lpFilePart=0x0) returned 0x34 [0081.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.307] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.307] GetFileType (hFile=0xe4) returned 0x1 [0081.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.307] GetFileType (hFile=0xe4) returned 0x1 [0081.307] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x10674 [0081.307] ReadFile (in: hFile=0xe4, lpBuffer=0x27b2124, nNumberOfBytesToRead=0x10674, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x27b2124*, lpNumberOfBytesRead=0x8fe75c*=0x10674, lpOverlapped=0x0) returned 1 [0081.308] CloseHandle (hObject=0xe4) returned 1 [0081.328] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", lpFilePart=0x0) returned 0x34 [0081.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.328] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.344] GetFileType (hFile=0xe4) returned 0x1 [0081.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.344] GetFileType (hFile=0xe4) returned 0x1 [0081.344] WriteFile (in: hFile=0xe4, lpBuffer=0x28302b8*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28302b8*, lpNumberOfBytesWritten=0x8fe74c*=0x10680, lpOverlapped=0x0) returned 1 [0081.346] CloseHandle (hObject=0xe4) returned 1 [0081.346] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", lpFilePart=0x0) returned 0x34 [0081.346] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.346] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fa921, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fa921, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c8b0c64, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10680)) returned 1 [0081.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.347] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.348] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", lpFilePart=0x0) returned 0x34 [0081.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.348] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.349] GetFileType (hFile=0xe4) returned 0x1 [0081.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.349] GetFileType (hFile=0xe4) returned 0x1 [0081.349] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x10698 [0081.349] ReadFile (in: hFile=0xe4, lpBuffer=0x2840dac, nNumberOfBytesToRead=0x10698, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2840dac*, lpNumberOfBytesRead=0x8fe75c*=0x10698, lpOverlapped=0x0) returned 1 [0081.350] CloseHandle (hObject=0xe4) returned 1 [0081.371] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", lpFilePart=0x0) returned 0x34 [0081.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.371] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.374] GetFileType (hFile=0xe4) returned 0x1 [0081.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.374] GetFileType (hFile=0xe4) returned 0x1 [0081.374] WriteFile (in: hFile=0xe4, lpBuffer=0x28befa0*, nNumberOfBytesToWrite=0x106a0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28befa0*, lpNumberOfBytesWritten=0x8fe74c*=0x106a0, lpOverlapped=0x0) returned 1 [0081.376] CloseHandle (hObject=0xe4) returned 1 [0081.376] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", lpFilePart=0x0) returned 0x34 [0081.376] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.376] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fe3b1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fe3b1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c8f98ca, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x106a0)) returned 1 [0081.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.377] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.377] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", lpFilePart=0x0) returned 0x34 [0081.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.377] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.378] GetFileType (hFile=0xe4) returned 0x1 [0081.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.378] GetFileType (hFile=0xe4) returned 0x1 [0081.378] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x13f94 [0081.378] ReadFile (in: hFile=0xe4, lpBuffer=0x28cfab4, nNumberOfBytesToRead=0x13f94, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28cfab4*, lpNumberOfBytesRead=0x8fe75c*=0x13f94, lpOverlapped=0x0) returned 1 [0081.379] CloseHandle (hObject=0xe4) returned 1 [0081.428] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", lpFilePart=0x0) returned 0x34 [0081.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.428] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.430] GetFileType (hFile=0xe4) returned 0x1 [0081.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.430] GetFileType (hFile=0xe4) returned 0x1 [0081.430] WriteFile (in: hFile=0xe4, lpBuffer=0x276cadc*, nNumberOfBytesToWrite=0x13fa0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x276cadc*, lpNumberOfBytesWritten=0x8fe74c*=0x13fa0, lpOverlapped=0x0) returned 1 [0081.431] CloseHandle (hObject=0xe4) returned 1 [0081.431] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", lpFilePart=0x0) returned 0x34 [0081.431] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.431] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ff747, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ff747, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c95fd14, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13fa0)) returned 1 [0081.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.431] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.432] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", lpFilePart=0x0) returned 0x34 [0081.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.432] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.432] GetFileType (hFile=0xe4) returned 0x1 [0081.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.432] GetFileType (hFile=0xe4) returned 0x1 [0081.432] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x10ac4 [0081.432] ReadFile (in: hFile=0xe4, lpBuffer=0x2780ef0, nNumberOfBytesToRead=0x10ac4, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2780ef0*, lpNumberOfBytesRead=0x8fe75c*=0x10ac4, lpOverlapped=0x0) returned 1 [0081.439] CloseHandle (hObject=0xe4) returned 1 [0081.457] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", lpFilePart=0x0) returned 0x34 [0081.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.457] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.458] GetFileType (hFile=0xe4) returned 0x1 [0081.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.458] GetFileType (hFile=0xe4) returned 0x1 [0081.458] WriteFile (in: hFile=0xe4, lpBuffer=0x27ffed0*, nNumberOfBytesToWrite=0x10ad0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x27ffed0*, lpNumberOfBytesWritten=0x8fe74c*=0x10ad0, lpOverlapped=0x0) returned 1 [0081.459] CloseHandle (hObject=0xe4) returned 1 [0081.460] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", lpFilePart=0x0) returned 0x34 [0081.460] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.460] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea400ac7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea400ac7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c9ac203, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10ad0)) returned 1 [0081.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.460] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.460] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", lpFilePart=0x0) returned 0x34 [0081.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.460] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.460] GetFileType (hFile=0xe4) returned 0x1 [0081.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.461] GetFileType (hFile=0xe4) returned 0x1 [0081.461] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x1158e [0081.461] ReadFile (in: hFile=0xe4, lpBuffer=0x2810e14, nNumberOfBytesToRead=0x1158e, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2810e14*, lpNumberOfBytesRead=0x8fe75c*=0x1158e, lpOverlapped=0x0) returned 1 [0081.462] CloseHandle (hObject=0xe4) returned 1 [0081.480] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", lpFilePart=0x0) returned 0x34 [0081.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.480] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.482] GetFileType (hFile=0xe4) returned 0x1 [0081.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.482] GetFileType (hFile=0xe4) returned 0x1 [0081.482] WriteFile (in: hFile=0xe4, lpBuffer=0x2891cdc*, nNumberOfBytesToWrite=0x11590, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2891cdc*, lpNumberOfBytesWritten=0x8fe74c*=0x11590, lpOverlapped=0x0) returned 1 [0081.488] CloseHandle (hObject=0xe4) returned 1 [0081.488] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", lpFilePart=0x0) returned 0x34 [0081.488] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.488] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea401e7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea401e7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c9f8bf0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11590)) returned 1 [0081.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.488] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.489] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", lpFilePart=0x0) returned 0x34 [0081.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.489] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.489] GetFileType (hFile=0xe4) returned 0x1 [0081.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.489] GetFileType (hFile=0xe4) returned 0x1 [0081.489] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x13160 [0081.489] ReadFile (in: hFile=0xe4, lpBuffer=0x28a36e0, nNumberOfBytesToRead=0x13160, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28a36e0*, lpNumberOfBytesRead=0x8fe75c*=0x13160, lpOverlapped=0x0) returned 1 [0081.491] CloseHandle (hObject=0xe4) returned 1 [0081.511] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", lpFilePart=0x0) returned 0x34 [0081.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.511] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.513] GetFileType (hFile=0xe4) returned 0x1 [0081.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.513] GetFileType (hFile=0xe4) returned 0x1 [0081.513] WriteFile (in: hFile=0xe4, lpBuffer=0x274dd3c*, nNumberOfBytesToWrite=0x13170, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x274dd3c*, lpNumberOfBytesWritten=0x8fe74c*=0x13170, lpOverlapped=0x0) returned 1 [0081.515] CloseHandle (hObject=0xe4) returned 1 [0081.516] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", lpFilePart=0x0) returned 0x34 [0081.516] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.516] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5c6190, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5c6190, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8ca453e5, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13170)) returned 1 [0081.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.516] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.516] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", lpFilePart=0x0) returned 0x34 [0081.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.516] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.516] GetFileType (hFile=0xe4) returned 0x1 [0081.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.517] GetFileType (hFile=0xe4) returned 0x1 [0081.517] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x454cc [0081.517] ReadFile (in: hFile=0xe4, lpBuffer=0x37eb828, nNumberOfBytesToRead=0x454cc, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x37eb828*, lpNumberOfBytesRead=0x8fe75c*=0x454cc, lpOverlapped=0x0) returned 1 [0081.525] CloseHandle (hObject=0xe4) returned 1 [0081.566] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", lpFilePart=0x0) returned 0x34 [0081.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.566] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.569] GetFileType (hFile=0xe4) returned 0x1 [0081.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.569] GetFileType (hFile=0xe4) returned 0x1 [0081.569] WriteFile (in: hFile=0xe4, lpBuffer=0x3946070*, nNumberOfBytesToWrite=0x454d0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x3946070*, lpNumberOfBytesWritten=0x8fe74c*=0x454d0, lpOverlapped=0x0) returned 1 [0081.573] CloseHandle (hObject=0xe4) returned 1 [0081.575] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", lpFilePart=0x0) returned 0x34 [0081.575] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.575] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cab71a6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x454d0)) returned 1 [0081.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.575] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.576] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", lpFilePart=0x0) returned 0x34 [0081.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.576] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.576] GetFileType (hFile=0xe4) returned 0x1 [0081.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.576] GetFileType (hFile=0xe4) returned 0x1 [0081.576] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x14021 [0081.576] ReadFile (in: hFile=0xe4, lpBuffer=0x27ae6f8, nNumberOfBytesToRead=0x14021, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x27ae6f8*, lpNumberOfBytesRead=0x8fe75c*=0x14021, lpOverlapped=0x0) returned 1 [0081.577] CloseHandle (hObject=0xe4) returned 1 [0081.638] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", lpFilePart=0x0) returned 0x34 [0081.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.638] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.639] GetFileType (hFile=0xe4) returned 0x1 [0081.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.639] GetFileType (hFile=0xe4) returned 0x1 [0081.639] WriteFile (in: hFile=0xe4, lpBuffer=0x28375a0*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28375a0*, lpNumberOfBytesWritten=0x8fe74c*=0x14030, lpOverlapped=0x0) returned 1 [0081.641] CloseHandle (hObject=0xe4) returned 1 [0081.641] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", lpFilePart=0x0) returned 0x34 [0081.641] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.641] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cb75d0c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x14030)) returned 1 [0081.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.641] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.642] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", lpFilePart=0x0) returned 0x34 [0081.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.642] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.642] GetFileType (hFile=0xe4) returned 0x1 [0081.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.642] GetFileType (hFile=0xe4) returned 0x1 [0081.642] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x1026f [0081.642] ReadFile (in: hFile=0xe4, lpBuffer=0x284ba44, nNumberOfBytesToRead=0x1026f, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x284ba44*, lpNumberOfBytesRead=0x8fe75c*=0x1026f, lpOverlapped=0x0) returned 1 [0081.643] CloseHandle (hObject=0xe4) returned 1 [0081.662] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", lpFilePart=0x0) returned 0x34 [0081.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.662] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.663] GetFileType (hFile=0xe4) returned 0x1 [0081.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.663] GetFileType (hFile=0xe4) returned 0x1 [0081.663] WriteFile (in: hFile=0xe4, lpBuffer=0x28c8fac*, nNumberOfBytesToWrite=0x10270, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x28c8fac*, lpNumberOfBytesWritten=0x8fe74c*=0x10270, lpOverlapped=0x0) returned 1 [0081.665] CloseHandle (hObject=0xe4) returned 1 [0081.665] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", lpFilePart=0x0) returned 0x34 [0081.665] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.665] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cb9c489, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10270)) returned 1 [0081.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.665] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.666] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", lpFilePart=0x0) returned 0x39 [0081.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.666] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.669] GetFileType (hFile=0xe4) returned 0x1 [0081.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.669] GetFileType (hFile=0xe4) returned 0x1 [0081.669] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x12720 [0081.669] ReadFile (in: hFile=0xe4, lpBuffer=0x28d96a0, nNumberOfBytesToRead=0x12720, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x28d96a0*, lpNumberOfBytesRead=0x8fe75c*=0x12720, lpOverlapped=0x0) returned 1 [0081.670] CloseHandle (hObject=0xe4) returned 1 [0081.698] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", lpFilePart=0x0) returned 0x39 [0081.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.698] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.700] GetFileType (hFile=0xe4) returned 0x1 [0081.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.700] GetFileType (hFile=0xe4) returned 0x1 [0081.700] WriteFile (in: hFile=0xe4, lpBuffer=0x26ffed8*, nNumberOfBytesToWrite=0x12730, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x26ffed8*, lpNumberOfBytesWritten=0x8fe74c*=0x12730, lpOverlapped=0x0) returned 1 [0081.705] CloseHandle (hObject=0xe4) returned 1 [0081.705] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", lpFilePart=0x0) returned 0x39 [0081.705] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x64 [0081.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.705] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cc0e7c5, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12730)) returned 1 [0081.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.705] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.705] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", lpFilePart=0x0) returned 0x34 [0081.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.706] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.706] GetFileType (hFile=0xe4) returned 0x1 [0081.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.706] GetFileType (hFile=0xe4) returned 0x1 [0081.706] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x112f7 [0081.706] ReadFile (in: hFile=0xe4, lpBuffer=0x2712aac, nNumberOfBytesToRead=0x112f7, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x2712aac*, lpNumberOfBytesRead=0x8fe75c*=0x112f7, lpOverlapped=0x0) returned 1 [0081.718] CloseHandle (hObject=0xe4) returned 1 [0081.756] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", lpFilePart=0x0) returned 0x34 [0081.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.756] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.757] GetFileType (hFile=0xe4) returned 0x1 [0081.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.757] GetFileType (hFile=0xe4) returned 0x1 [0081.757] WriteFile (in: hFile=0xe4, lpBuffer=0x2793320*, nNumberOfBytesToWrite=0x11300, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2793320*, lpNumberOfBytesWritten=0x8fe74c*=0x11300, lpOverlapped=0x0) returned 1 [0081.759] CloseHandle (hObject=0xe4) returned 1 [0081.759] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", lpFilePart=0x0) returned 0x34 [0081.759] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.759] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cc80eef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11300)) returned 1 [0081.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.759] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.760] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", lpFilePart=0x0) returned 0x34 [0081.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.760] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xe4 [0081.760] GetFileType (hFile=0xe4) returned 0x1 [0081.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.760] GetFileType (hFile=0xe4) returned 0x1 [0081.760] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x3e0c1 [0081.761] ReadFile (in: hFile=0xe4, lpBuffer=0x3710d48, nNumberOfBytesToRead=0x3e0c1, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x3710d48*, lpNumberOfBytesRead=0x8fe75c*=0x3e0c1, lpOverlapped=0x0) returned 1 [0081.767] CloseHandle (hObject=0xe4) returned 1 [0081.819] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", lpFilePart=0x0) returned 0x34 [0081.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.820] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0081.822] GetFileType (hFile=0x260) returned 0x1 [0081.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.822] GetFileType (hFile=0x260) returned 0x1 [0081.822] WriteFile (in: hFile=0x260, lpBuffer=0x3847188*, nNumberOfBytesToWrite=0x3e0d0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x3847188*, lpNumberOfBytesWritten=0x8fe74c*=0x3e0d0, lpOverlapped=0x0) returned 1 [0081.825] CloseHandle (hObject=0x260) returned 1 [0081.825] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", lpFilePart=0x0) returned 0x34 [0081.825] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.825] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cd3faa0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3e0d0)) returned 1 [0081.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.826] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.826] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", lpFilePart=0x0) returned 0x34 [0081.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.826] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0081.826] GetFileType (hFile=0x260) returned 0x1 [0081.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.826] GetFileType (hFile=0x260) returned 0x1 [0081.826] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x12581 [0081.826] ReadFile (in: hFile=0x260, lpBuffer=0x27f1d1c, nNumberOfBytesToRead=0x12581, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x27f1d1c*, lpNumberOfBytesRead=0x8fe75c*=0x12581, lpOverlapped=0x0) returned 1 [0081.828] CloseHandle (hObject=0x260) returned 1 [0081.847] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", lpFilePart=0x0) returned 0x34 [0081.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.847] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0081.848] GetFileType (hFile=0x260) returned 0x1 [0081.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.848] GetFileType (hFile=0x260) returned 0x1 [0081.848] WriteFile (in: hFile=0x260, lpBuffer=0x2875be4*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x2875be4*, lpNumberOfBytesWritten=0x8fe74c*=0x12590, lpOverlapped=0x0) returned 1 [0081.849] CloseHandle (hObject=0x260) returned 1 [0081.849] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", lpFilePart=0x0) returned 0x34 [0081.849] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.850] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cd65c32, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12590)) returned 1 [0081.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.850] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.850] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", lpFilePart=0x0) returned 0x34 [0081.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.850] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0081.854] GetFileType (hFile=0x260) returned 0x1 [0081.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.854] GetFileType (hFile=0x260) returned 0x1 [0081.854] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x411eb [0081.855] ReadFile (in: hFile=0x260, lpBuffer=0x38a9d98, nNumberOfBytesToRead=0x411eb, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x38a9d98*, lpNumberOfBytesRead=0x8fe75c*=0x411eb, lpOverlapped=0x0) returned 1 [0081.860] CloseHandle (hObject=0x260) returned 1 [0081.898] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", lpFilePart=0x0) returned 0x34 [0081.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.898] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0081.900] GetFileType (hFile=0x260) returned 0x1 [0081.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.900] GetFileType (hFile=0x260) returned 0x1 [0081.900] WriteFile (in: hFile=0x260, lpBuffer=0x36c98e8*, nNumberOfBytesToWrite=0x411f0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x36c98e8*, lpNumberOfBytesWritten=0x8fe74c*=0x411f0, lpOverlapped=0x0) returned 1 [0081.906] CloseHandle (hObject=0x260) returned 1 [0081.906] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", lpFilePart=0x0) returned 0x34 [0081.906] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.906] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cdfe579, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x411f0)) returned 1 [0081.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.906] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.907] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", lpFilePart=0x0) returned 0x34 [0081.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.907] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0081.907] GetFileType (hFile=0x260) returned 0x1 [0081.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.907] GetFileType (hFile=0x260) returned 0x1 [0081.907] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x1ed21 [0081.907] ReadFile (in: hFile=0x260, lpBuffer=0x370aaf8, nNumberOfBytesToRead=0x1ed21, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x370aaf8*, lpNumberOfBytesRead=0x8fe75c*=0x1ed21, lpOverlapped=0x0) returned 1 [0081.909] CloseHandle (hObject=0x260) returned 1 [0081.950] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", lpFilePart=0x0) returned 0x34 [0081.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.950] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0081.951] GetFileType (hFile=0x260) returned 0x1 [0081.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.951] GetFileType (hFile=0x260) returned 0x1 [0081.951] WriteFile (in: hFile=0x260, lpBuffer=0x37a4d18*, nNumberOfBytesToWrite=0x1ed30, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x37a4d18*, lpNumberOfBytesWritten=0x8fe74c*=0x1ed30, lpOverlapped=0x0) returned 1 [0081.953] CloseHandle (hObject=0x260) returned 1 [0081.953] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", lpFilePart=0x0) returned 0x34 [0081.953] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.953] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8ce70c41, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1ed30)) returned 1 [0081.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.953] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.954] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", lpFilePart=0x0) returned 0x34 [0081.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.954] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0081.954] GetFileType (hFile=0x260) returned 0x1 [0081.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.954] GetFileType (hFile=0x260) returned 0x1 [0081.954] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x23ec4 [0081.954] ReadFile (in: hFile=0x260, lpBuffer=0x37c3a68, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x37c3a68*, lpNumberOfBytesRead=0x8fe75c*=0x23ec4, lpOverlapped=0x0) returned 1 [0081.957] CloseHandle (hObject=0x260) returned 1 [0081.980] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", lpFilePart=0x0) returned 0x34 [0081.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0081.980] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0081.986] GetFileType (hFile=0x260) returned 0x1 [0081.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0081.986] GetFileType (hFile=0x260) returned 0x1 [0081.986] WriteFile (in: hFile=0x260, lpBuffer=0x38774a8*, nNumberOfBytesToWrite=0x23ed0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x38774a8*, lpNumberOfBytesWritten=0x8fe74c*=0x23ed0, lpOverlapped=0x0) returned 1 [0081.988] CloseHandle (hObject=0x260) returned 1 [0081.988] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", lpFilePart=0x0) returned 0x34 [0081.988] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0081.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0081.988] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cebd1d5, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x23ed0)) returned 1 [0081.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0081.988] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0081.988] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", nBufferLength=0x105, lpBuffer=0x8fe170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", lpFilePart=0x0) returned 0x34 [0081.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6b4) returned 1 [0081.989] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0081.989] GetFileType (hFile=0x260) returned 0x1 [0081.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6b0) returned 1 [0081.989] GetFileType (hFile=0x260) returned 0x1 [0081.989] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x8fe7b0 | out: lpFileSizeHigh=0x8fe7b0*=0x0) returned 0x23ec4 [0081.989] ReadFile (in: hFile=0x260, lpBuffer=0x389b398, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x8fe75c, lpOverlapped=0x0 | out: lpBuffer=0x389b398*, lpNumberOfBytesRead=0x8fe75c*=0x23ec4, lpOverlapped=0x0) returned 1 [0081.991] CloseHandle (hObject=0x260) returned 1 [0082.011] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", nBufferLength=0x105, lpBuffer=0x8fe158, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", lpFilePart=0x0) returned 0x34 [0082.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe69c) returned 1 [0082.011] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0082.013] GetFileType (hFile=0x260) returned 0x1 [0082.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe698) returned 1 [0082.013] GetFileType (hFile=0x260) returned 0x1 [0082.013] WriteFile (in: hFile=0x260, lpBuffer=0x39ef780*, nNumberOfBytesToWrite=0x23ed0, lpNumberOfBytesWritten=0x8fe74c, lpOverlapped=0x0 | out: lpBuffer=0x39ef780*, lpNumberOfBytesWritten=0x8fe74c*=0x23ed0, lpOverlapped=0x0) returned 1 [0082.015] CloseHandle (hObject=0x260) returned 1 [0082.015] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", lpFilePart=0x0) returned 0x34 [0082.015] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x5f [0082.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe734) returned 1 [0082.015] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), fInfoLevelId=0x0, lpFileInformation=0x8fe7b0 | out: lpFileInformation=0x8fe7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cf096a2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x23ed0)) returned 1 [0082.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0082.015] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0082.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0082.016] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\EULA", lpFilePart=0x0) returned 0x25 [0082.016] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8cf096a2, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8cf096a2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1508 [0082.016] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8cf096a2, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8cf096a2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.016] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c6124, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c6124, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bd344a3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1af70, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ar-sa.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_A~1.MAD")) returned 1 [0082.016] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c74ab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c74ab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bdf2f97, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3de10, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_bg-bg.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_B~1.MAD")) returned 1 [0082.017] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c882e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c882e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8be8b940, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x14580, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_cs-cz.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_C~1.MAD")) returned 1 [0082.017] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3caf18, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3caf18, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8befe0e9, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_da-dk.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_D~1.MAD")) returned 1 [0082.017] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d10e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d10e9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bf24206, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11340, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_de-de.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_D~2.MAD")) returned 1 [0082.017] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d2466, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d2466, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bf96951, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3a760, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_el-gr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_E~1.MAD")) returned 1 [0082.017] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d5f05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d5f05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8bfe7e21, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_en-gb.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_E~2.MAD")) returned 1 [0082.017] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d997f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d997f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c055501, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xe4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_en-us.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_E~3.MAD")) returned 1 [0082.017] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dad37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dad37, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c0a1963, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_es-es.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_E~4.MAD")) returned 1 [0082.017] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dc0bd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dc0bd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c114069, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_es-mx.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EUEE77~1.MAD")) returned 1 [0082.017] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dd45a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dd45a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c1867a6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xf680, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_et-ee.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EUCC3B~1.MAD")) returned 1 [0082.017] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dfb2b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dfb2b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c1f8ea2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11460, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_fi-fi.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_F~1.MAD")) returned 1 [0082.018] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e0ee6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e0ee6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c21f197, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_fr-ca.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_F~2.MAD")) returned 1 [0082.018] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e2266, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e2266, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c26b55d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_fr-fr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_F~3.MAD")) returned 1 [0082.018] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e35dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e35dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c3e8e15, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xd3190, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_he-il.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_H~1.MAD")) returned 1 [0082.018] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e977f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e977f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c45b59d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0xfd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_hr-hr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_H~2.MAD")) returned 1 [0082.018] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ebeab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ebeab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c481714, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x14a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_hu-hu.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_H~3.MAD")) returned 1 [0082.018] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ed234, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ed234, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c4cdc2d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_it-it.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_I~1.MAD")) returned 1 [0082.018] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ef94a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ef94a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c51a1a3, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x33550, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ja-jp.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_J~1.MAD")) returned 1 [0082.018] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f205a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f205a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c5ff006, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x9acf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ko-kr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_K~1.MAD")) returned 1 [0082.019] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f33e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f33e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c77c62d, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12940, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_lt-lt.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_L~1.MAD")) returned 1 [0082.019] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f5af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f5af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c83b11f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x147d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_lv-lv.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_L~2.MAD")) returned 1 [0082.019] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fa921, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fa921, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c8b0c64, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10680, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_nb-no.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_N~1.MAD")) returned 1 [0082.019] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fe3b1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fe3b1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c8f98ca, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x106a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_nl-nl.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_N~2.MAD")) returned 1 [0082.019] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ff747, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ff747, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c95fd14, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_pl-pl.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_P~1.MAD")) returned 1 [0082.019] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea400ac7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea400ac7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c9ac203, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_pt-br.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_P~2.MAD")) returned 1 [0082.019] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea401e7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea401e7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8c9f8bf0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11590, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_pt-pt.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_P~3.MAD")) returned 1 [0082.019] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5c6190, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5c6190, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8ca453e5, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x13170, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ro-ro.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_R~1.MAD")) returned 1 [0082.019] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cab71a6, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x454d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ru-ru.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_R~2.MAD")) returned 1 [0082.020] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cb75d0c, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x14030, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sk-sk.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_S~1.MAD")) returned 1 [0082.020] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cb9c489, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x10270, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sl-si.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_S~2.MAD")) returned 1 [0082.020] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cc0e7c5, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12730, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sr-latn-cs.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_S~3.MAD")) returned 1 [0082.020] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cc80eef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x11300, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sv-se.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_S~4.MAD")) returned 1 [0082.020] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cd3faa0, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x3e0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_th-th.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_T~1.MAD")) returned 1 [0082.020] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cd65c32, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x12590, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_tr-tr.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_T~2.MAD")) returned 1 [0082.020] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cdfe579, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x411f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_uk-ua.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_U~1.MAD")) returned 1 [0082.020] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8ce70c41, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1ed30, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-cn.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_Z~1.MAD")) returned 1 [0082.020] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cebd1d5, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x23ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-hk.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_Z~2.MAD")) returned 1 [0082.021] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cf096a2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x23ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-tw.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_Z~3.MAD")) returned 1 [0082.021] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8cf096a2, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x23ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-tw.htm.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="EULA_Z~3.MAD")) returned 0 [0082.021] FindClose (in: hFindFile=0xac1508 | out: hFindFile=0xac1508) returned 1 [0082.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0082.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0082.021] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS", nBufferLength=0x105, lpBuffer=0x8fe294, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS", lpFilePart=0x0) returned 0x30 [0082.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0082.021] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS", lpFilePart=0x0) returned 0x30 [0082.021] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1508 [0082.021] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.021] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0082.021] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0082.022] FindNextFileW (in: hFindFile=0xac1508, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0082.022] FindClose (in: hFindFile=0xac1508 | out: hFindFile=0xac1508) returned 1 [0082.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0082.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0082.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7ac) returned 1 [0082.022] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS", nBufferLength=0x105, lpBuffer=0x8fe260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS", lpFilePart=0x0) returned 0x30 [0082.022] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*", lpFindFileData=0x8fe4d4 | out: lpFindFileData=0x8fe4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0f08 [0082.022] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.022] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0082.022] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0082.022] FindNextFileW (in: hFindFile=0xac0f08, lpFindFileData=0x8fe4e0 | out: lpFindFileData=0x8fe4e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.022] FindClose (in: hFindFile=0xac0f08 | out: hFindFile=0xac0f08) returned 1 [0082.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe768) returned 1 [0082.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe774) returned 1 [0082.022] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css", nBufferLength=0x105, lpBuffer=0x8fe250, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css", lpFilePart=0x0) returned 0x34 [0082.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0082.023] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css", lpFilePart=0x0) returned 0x34 [0082.023] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e88 [0082.024] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.024] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe-desktop.css", cAlternateFileName="OOBE-D~1.CSS")) returned 1 [0082.024] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-dark.css", cAlternateFileName="")) returned 1 [0082.024] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.024] FindClose (in: hFindFile=0xac0e88 | out: hFindFile=0xac0e88) returned 1 [0082.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0082.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0082.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0082.025] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css", lpFilePart=0x0) returned 0x34 [0082.025] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1288 [0082.025] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.025] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe-desktop.css", cAlternateFileName="OOBE-D~1.CSS")) returned 1 [0082.025] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-dark.css", cAlternateFileName="")) returned 1 [0082.025] FindNextFileW (in: hFindFile=0xac1288, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-dark.css", cAlternateFileName="")) returned 0 [0082.025] FindClose (in: hFindFile=0xac1288 | out: hFindFile=0xac1288) returned 1 [0082.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0082.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0082.025] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js", nBufferLength=0x105, lpBuffer=0x8fe250, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js", lpFilePart=0x0) returned 0x33 [0082.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0082.025] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js", lpFilePart=0x0) returned 0x33 [0082.025] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac0e88 [0082.026] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.026] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1395c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.js", cAlternateFileName="")) returned 1 [0082.026] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui.js", cAlternateFileName="")) returned 1 [0082.026] FindNextFileW (in: hFindFile=0xac0e88, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.026] FindClose (in: hFindFile=0xac0e88 | out: hFindFile=0xac0e88) returned 1 [0082.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0082.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0082.026] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", lpFilePart=0x0) returned 0x3b [0082.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0082.026] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0082.026] GetFileType (hFile=0x260) returned 0x1 [0082.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0082.026] GetFileType (hFile=0x260) returned 0x1 [0082.026] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x1395c6 [0082.029] ReadFile (in: hFile=0x260, lpBuffer=0x3a13670, nNumberOfBytesToRead=0x1395c6, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x3a13670*, lpNumberOfBytesRead=0x8fe718*=0x1395c6, lpOverlapped=0x0) returned 1 [0082.051] CloseHandle (hObject=0x260) returned 1 [0082.157] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", lpFilePart=0x0) returned 0x3b [0082.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0082.157] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0082.159] GetFileType (hFile=0x260) returned 0x1 [0082.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0082.159] GetFileType (hFile=0x260) returned 0x1 [0082.159] WriteFile (in: hFile=0x260, lpBuffer=0x36c98e8*, nNumberOfBytesToWrite=0x1395d0, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x36c98e8*, lpNumberOfBytesWritten=0x8fe708*=0x1395d0, lpOverlapped=0x0) returned 1 [0082.177] CloseHandle (hObject=0x260) returned 1 [0082.177] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", lpFilePart=0x0) returned 0x3b [0082.177] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x66 [0082.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0082.177] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8d086f0f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1395d0)) returned 1 [0082.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0082.178] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0082.178] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", nBufferLength=0x105, lpBuffer=0x8fe12c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", lpFilePart=0x0) returned 0x39 [0082.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe670) returned 1 [0082.178] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0082.178] GetFileType (hFile=0x260) returned 0x1 [0082.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe66c) returned 1 [0082.178] GetFileType (hFile=0x260) returned 0x1 [0082.178] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x8fe76c | out: lpFileSizeHigh=0x8fe76c*=0x0) returned 0x2e7dba [0082.186] ReadFile (in: hFile=0x260, lpBuffer=0x3802ed8, nNumberOfBytesToRead=0x2e7dba, lpNumberOfBytesRead=0x8fe718, lpOverlapped=0x0 | out: lpBuffer=0x3802ed8*, lpNumberOfBytesRead=0x8fe718*=0x2e7dba, lpOverlapped=0x0) returned 1 [0082.228] CloseHandle (hObject=0x260) returned 1 [0082.567] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", nBufferLength=0x105, lpBuffer=0x8fe114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", lpFilePart=0x0) returned 0x39 [0082.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe658) returned 1 [0082.567] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0082.573] GetFileType (hFile=0x260) returned 0x1 [0082.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe654) returned 1 [0082.573] GetFileType (hFile=0x260) returned 0x1 [0082.573] WriteFile (in: hFile=0x260, lpBuffer=0x3c99468*, nNumberOfBytesToWrite=0x2e7dc0, lpNumberOfBytesWritten=0x8fe708, lpOverlapped=0x0 | out: lpBuffer=0x3c99468*, lpNumberOfBytesWritten=0x8fe708*=0x2e7dc0, lpOverlapped=0x0) returned 1 [0082.762] CloseHandle (hObject=0x260) returned 1 [0082.762] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", lpFilePart=0x0) returned 0x39 [0082.762] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", nBufferLength=0x105, lpBuffer=0x8fe23c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", lpFilePart=0x0) returned 0x64 [0082.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6f0) returned 1 [0082.762] GetFileAttributesExW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), fInfoLevelId=0x0, lpFileInformation=0x8fe76c | out: lpFileInformation=0x8fe76c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8d62d6ef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dc0)) returned 1 [0082.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe6ec) returned 1 [0082.762] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.id-N4BQCA40.[maddogteam@airmail.cc].MadDog" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js.id-n4bqca40.[maddogteam@airmail.cc].maddog")) returned 1 [0082.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe768) returned 1 [0082.763] GetFullPathNameW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js", nBufferLength=0x105, lpBuffer=0x8fe21c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js", lpFilePart=0x0) returned 0x33 [0082.763] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*", lpFindFileData=0x8fe490 | out: lpFindFileData=0x8fe490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8d62d6ef, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8d62d6ef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xac1548 [0082.763] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8d62d6ef, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x8d62d6ef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.764] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8d086f0f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x1395d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.js.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="BASEJS~1.MAD")) returned 1 [0082.764] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8d62d6ef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui.js.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UIJSID~1.MAD")) returned 1 [0082.764] FindNextFileW (in: hFindFile=0xac1548, lpFindFileData=0x8fe49c | out: lpFindFileData=0x8fe49c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8d62d6ef, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui.js.id-N4BQCA40.[maddogteam@airmail.cc].MadDog", cAlternateFileName="UIJSID~1.MAD")) returned 0 [0082.764] FindClose (in: hFindFile=0xac1548 | out: hFindFile=0xac1548) returned 1 [0082.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe724) returned 1 [0082.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe730) returned 1 [0082.771] CoTaskMemAlloc (cb=0x20c) returned 0xb277a8 [0082.771] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xb277a8 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0082.771] CoTaskMemFree (pv=0xb277a8) [0082.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x8fe370, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0082.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\MadDog", nBufferLength=0x105, lpBuffer=0x8fe404, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\MadDog", lpFilePart=0x0) returned 0x26 [0082.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe840) returned 1 [0082.771] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\MadDog" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\maddog"), fInfoLevelId=0x0, lpFileInformation=0x8fe8bc | out: lpFileInformation=0x8fe8bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0082.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe83c) returned 1 [0082.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe840) returned 1 [0082.772] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\MadDog" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\maddog"), fInfoLevelId=0x0, lpFileInformation=0x8fe8bc | out: lpFileInformation=0x8fe8bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0082.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe83c) returned 1 [0082.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe840) returned 1 [0082.772] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x8fe8bc | out: lpFileInformation=0x8fe8bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xfa905a6, ftLastAccessTime.dwHighDateTime=0x1d63332, ftLastWriteTime.dwLowDateTime=0xfa905a6, ftLastWriteTime.dwHighDateTime=0x1d63332, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0082.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe83c) returned 1 [0082.775] CreateDirectoryW (lpPathName="C:\\Users\\FD1HVy\\AppData\\Roaming\\MadDog" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\maddog"), lpSecurityAttributes=0x0) returned 1 [0082.778] CoTaskMemAlloc (cb=0x20c) returned 0xb277a8 [0082.778] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0xb277a8 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0082.778] CoTaskMemFree (pv=0xb277a8) [0082.778] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x8fe370, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming", lpFilePart=0x0) returned 0x1f [0082.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\MadDog\\MadDog-N4BQCA40.MadKey", nBufferLength=0x105, lpBuffer=0x8fe2b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\MadDog\\MadDog-N4BQCA40.MadKey", lpFilePart=0x0) returned 0x3d [0082.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7f8) returned 1 [0082.779] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\MadDog\\MadDog-N4BQCA40.MadKey" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\maddog\\maddog-n4bqca40.madkey"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0082.779] GetFileType (hFile=0x260) returned 0x1 [0082.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7f4) returned 1 [0082.779] GetFileType (hFile=0x260) returned 0x1 [0082.779] WriteFile (in: hFile=0x260, lpBuffer=0x26f1424*, nNumberOfBytesToWrite=0xa8, lpNumberOfBytesWritten=0x8fe874, lpOverlapped=0x0 | out: lpBuffer=0x26f1424*, lpNumberOfBytesWritten=0x8fe874*=0xa8, lpOverlapped=0x0) returned 1 [0082.780] CloseHandle (hObject=0x260) returned 1 [0082.810] CreatePipe (in: hReadPipe=0x8fe81c, hWritePipe=0x8fe818, lpPipeAttributes=0x8fe79c, nSize=0x0 | out: hReadPipe=0x8fe81c*=0xe4, hWritePipe=0x8fe818*=0x334) returned 1 [0082.811] GetCurrentProcess () returned 0xffffffff [0082.811] GetCurrentProcess () returned 0xffffffff [0082.811] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x334, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x8fe820, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x8fe820*=0x3e4) returned 1 [0082.811] CloseHandle (hObject=0x334) returned 1 [0082.811] CreatePipe (in: hReadPipe=0x8fe81c, hWritePipe=0x8fe818, lpPipeAttributes=0x8fe79c, nSize=0x0 | out: hReadPipe=0x8fe81c*=0x334, hWritePipe=0x8fe818*=0x3f4) returned 1 [0082.812] GetCurrentProcess () returned 0xffffffff [0082.812] GetCurrentProcess () returned 0xffffffff [0082.812] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x334, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x8fe820, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x8fe820*=0x3f8) returned 1 [0082.812] CloseHandle (hObject=0x334) returned 1 [0082.812] CreatePipe (in: hReadPipe=0x8fe81c, hWritePipe=0x8fe818, lpPipeAttributes=0x8fe79c, nSize=0x0 | out: hReadPipe=0x8fe81c*=0x334, hWritePipe=0x8fe818*=0x3fc) returned 1 [0082.812] GetCurrentProcess () returned 0xffffffff [0082.812] GetCurrentProcess () returned 0xffffffff [0082.812] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x334, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x8fe820, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x8fe820*=0x404) returned 1 [0082.812] CloseHandle (hObject=0x334) returned 1 [0082.812] CoTaskMemAlloc (cb=0x20e) returned 0xb277a8 [0082.812] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0xb277a8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0082.812] CoTaskMemFree (pv=0xb277a8) [0082.813] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"cmd.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x8fe784*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe4, hStdOutput=0x3f4, hStdError=0x3fc), lpProcessInformation=0x26f27d4 | out: lpCommandLine="\"cmd.exe\"", lpProcessInformation=0x26f27d4*(hProcess=0x408, hThread=0x334, dwProcessId=0x57c, dwThreadId=0x728)) returned 1 [0083.076] CloseHandle (hObject=0xe4) returned 1 [0083.076] CloseHandle (hObject=0x3f4) returned 1 [0083.076] CloseHandle (hObject=0x3fc) returned 1 [0083.078] GetFileType (hFile=0x3e4) returned 0x3 [0083.084] GetFileType (hFile=0x3f8) returned 0x3 [0083.084] GetFileType (hFile=0x404) returned 0x3 [0083.085] CloseHandle (hObject=0x334) returned 1 [0083.085] WriteFile (in: hFile=0x3e4, lpBuffer=0x26fc5b0*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x8fe8b4, lpOverlapped=0x0 | out: lpBuffer=0x26fc5b0*, lpNumberOfBytesWritten=0x8fe8b4*=0x3a, lpOverlapped=0x0) returned 1 [0083.086] GetCurrentProcess () returned 0xffffffff [0083.086] GetCurrentProcess () returned 0xffffffff [0083.086] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x408, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x8fe8dc, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x8fe8dc*=0x334) returned 1 [0083.087] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x8fe8d4*=0x334, lpdwindex=0x8fe6f4 | out: lpdwindex=0x8fe6f4) returned 0x0 [0092.373] CloseHandle (hObject=0x334) returned 1 [0092.373] CloseHandle (hObject=0x408) returned 1 [0092.375] ShellExecuteExW (in: pExecInfo=0x26fd6e0*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Windows\\system32\\wbadmin.exe delete catalog -quiet", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26fd6e0*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Windows\\system32\\wbadmin.exe delete catalog -quiet", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 0 [0092.431] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2, dwLanguageId=0x0, lpBuffer=0x8fe65c, nSize=0x101, Arguments=0x0 | out: lpBuffer="The system cannot find the file specified.\r\n") returned 0x2c [0092.434] LocalFree (hMem=0xb2dbb0) returned 0x0 [0092.434] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0xb42b40 [0092.434] ShellExecuteExW (in: pExecInfo=0x26fde58*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Windows\\System32\\bcdedit.exe /set recoveryenabled No", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26fde58*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Windows\\System32\\bcdedit.exe /set recoveryenabled No", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 0 [0092.743] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2, dwLanguageId=0x0, lpBuffer=0x8fe65c, nSize=0x101, Arguments=0x0 | out: lpBuffer="The system cannot find the file specified.\r\n") returned 0x2c [0092.744] LocalFree (hMem=0xb42b40) returned 0x0 [0092.757] EtwEventRegister (in: ProviderId=0x26fed84, EnableCallback=0x4cd0636, CallbackContext=0x0, RegHandle=0x26fed60 | out: RegHandle=0x26fed60) returned 0x0 [0092.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe.config", nBufferLength=0x105, lpBuffer=0x8fe1e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe.config", lpFilePart=0x0) returned 0x33 [0092.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe6a0) returned 1 [0092.760] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qrej4lz7xrqQfsU3.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\qrej4lz7xrqqfsu3.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x8fe71c | out: lpFileInformation=0x8fe71c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0092.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe69c) returned 1 [0092.909] CoTaskMemAlloc (cb=0x20c) returned 0x6728b28 [0092.909] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x6728b28 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0092.910] CoTaskMemFree (pv=0x6728b28) [0092.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x8fe378, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0092.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Info.hta", nBufferLength=0x105, lpBuffer=0x8fe2bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Info.hta", lpFilePart=0x0) returned 0x20 [0092.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0092.910] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Info.hta" (normalized: "c:\\users\\fd1hvy\\desktop\\info.hta"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x494 [0092.910] GetFileType (hFile=0x494) returned 0x1 [0092.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0092.910] GetFileType (hFile=0x494) returned 0x1 [0092.911] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.911] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.912] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.912] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.912] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.912] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.913] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.913] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.913] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.913] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.913] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.914] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.914] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.914] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.914] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.915] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.915] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.915] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.915] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.915] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.916] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.916] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.916] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.916] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.916] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.917] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.917] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.917] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.917] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.917] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.918] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.918] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.918] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.918] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.919] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.919] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.919] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.919] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.919] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.920] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.920] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.920] WriteFile (in: hFile=0x494, lpBuffer=0x2702f8c*, nNumberOfBytesToWrite=0x584, lpNumberOfBytesWritten=0x8fe87c, lpOverlapped=0x0 | out: lpBuffer=0x2702f8c*, lpNumberOfBytesWritten=0x8fe87c*=0x584, lpOverlapped=0x0) returned 1 [0092.920] CloseHandle (hObject=0x494) returned 1 [0092.920] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\Info.hta", nBufferLength=0x105, lpBuffer=0x8fe2bc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\Info.hta", lpFilePart=0x0) returned 0x45 [0092.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0092.921] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\Info.hta" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\info.hta"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x494 [0092.922] GetFileType (hFile=0x494) returned 0x1 [0092.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0092.922] GetFileType (hFile=0x494) returned 0x1 [0092.922] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.923] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.923] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.924] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.924] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.924] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.925] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.925] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.925] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.925] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.925] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.926] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.926] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.926] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.927] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.927] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.927] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.927] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.927] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.928] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.928] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.928] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.928] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.929] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.929] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.929] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.929] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.929] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.929] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.930] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.930] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.930] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.930] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.930] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.930] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.930] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.931] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.931] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.931] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.931] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.931] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fe8b8, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe8b8*=0x1000, lpOverlapped=0x0) returned 1 [0092.931] WriteFile (in: hFile=0x494, lpBuffer=0x2705534*, nNumberOfBytesToWrite=0x584, lpNumberOfBytesWritten=0x8fe87c, lpOverlapped=0x0 | out: lpBuffer=0x2705534*, lpNumberOfBytesWritten=0x8fe87c*=0x584, lpOverlapped=0x0) returned 1 [0092.931] CloseHandle (hObject=0x494) returned 1 [0092.932] CoTaskMemAlloc (cb=0x20c) returned 0x6728b28 [0092.932] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x6728b28 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0092.932] CoTaskMemFree (pv=0x6728b28) [0092.932] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x8fe378, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0092.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\FILES ENCRYPTED.txt", nBufferLength=0x105, lpBuffer=0x8fe2bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\FILES ENCRYPTED.txt", lpFilePart=0x0) returned 0x2b [0092.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe800) returned 1 [0092.933] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FILES ENCRYPTED.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\files encrypted.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x494 [0092.934] GetFileType (hFile=0x494) returned 0x1 [0092.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7fc) returned 1 [0092.934] GetFileType (hFile=0x494) returned 0x1 [0092.934] WriteFile (in: hFile=0x494, lpBuffer=0x27081f4*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x8fe87c, lpOverlapped=0x0 | out: lpBuffer=0x27081f4*, lpNumberOfBytesWritten=0x8fe87c*=0x71, lpOverlapped=0x0) returned 1 [0092.934] CloseHandle (hObject=0x494) returned 1 [0092.935] CoTaskMemAlloc (cb=0x20c) returned 0x6728b28 [0092.935] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x6728b28 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0092.935] CoTaskMemFree (pv=0x6728b28) [0092.935] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x8fe378, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0092.935] LocalAlloc (uFlags=0x0, uBytes=0x58) returned 0xae49f8 [0092.935] ShellExecuteExW (in: pExecInfo=0x2709910*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\Desktop\\FILES ENCRYPTED.txt", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2709910*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\Desktop\\FILES ENCRYPTED.txt", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x5e8)) returned 1 [0093.408] LocalFree (hMem=0xae49f8) returned 0x0 [0093.408] CoTaskMemAlloc (cb=0x20c) returned 0xb36870 [0093.408] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0xb36870 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0093.408] CoTaskMemFree (pv=0xb36870) [0093.408] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x8fe378, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0093.408] LocalAlloc (uFlags=0x0, uBytes=0x42) returned 0x672cdb0 [0093.408] ShellExecuteExW (in: pExecInfo=0x270a07c*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\Desktop\\Info.hta", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x270a07c*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\Desktop\\Info.hta", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x498)) returned 1 [0094.661] LocalFree (hMem=0x672cdb0) returned 0x0 [0094.661] CoTaskMemAlloc (cb=0x20c) returned 0x6728b28 [0094.661] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x6728b28 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0094.661] CoTaskMemFree (pv=0x6728b28) [0094.661] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x8fe378, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0094.661] LocalAlloc (uFlags=0x0, uBytes=0x42) returned 0x672cd60 [0094.661] ShellExecuteExW (in: pExecInfo=0x270a7e8*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\Desktop\\Info.hta", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x270a7e8*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\Desktop\\Info.hta", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x50c)) returned 1 [0095.533] LocalFree (hMem=0x672cd60) returned 0x0 [0095.533] CoTaskMemAlloc (cb=0x20c) returned 0x6728b28 [0095.533] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x6728b28 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0095.533] CoTaskMemFree (pv=0x6728b28) [0095.533] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x8fe378, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0095.533] LocalAlloc (uFlags=0x0, uBytes=0x42) returned 0x672d080 [0095.533] ShellExecuteExW (in: pExecInfo=0x270af54*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\Desktop\\Info.hta", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x270af54*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\Desktop\\Info.hta", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x61c)) returned 1 [0097.594] LocalFree (hMem=0x672d080) returned 0x0 [0097.594] CoTaskMemAlloc (cb=0x20c) returned 0x6728b28 [0097.594] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x6728b28 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0097.594] CoTaskMemFree (pv=0x6728b28) [0097.595] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x8fe378, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0097.595] LocalAlloc (uFlags=0x0, uBytes=0x42) returned 0x672ca40 [0097.595] ShellExecuteExW (in: pExecInfo=0x270b6c0*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\Desktop\\Info.hta", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x270b6c0*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\FD1HVy\\Desktop\\Info.hta", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x624)) returned 1 [0098.702] LocalFree (hMem=0x672ca40) returned 0x0 [0098.724] GetWindowThreadProcessId (in: hWnd=0x6014c, lpdwProcessId=0x8fe950 | out: lpdwProcessId=0x8fe950) returned 0x1234 [0098.724] GetCurrentThreadId () returned 0x1234 [0098.724] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc1bb [0098.725] PostMessageW (hWnd=0x6014c, Msg=0xc1bb, wParam=0x0, lParam=0x0) returned 1 [0098.725] GetWindowTextLengthW (hWnd=0x6014c) returned 0 [0098.725] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0098.726] GetSystemMetrics (nIndex=42) returned 0 [0098.726] GetWindowTextW (in: hWnd=0x6014c, lpString=0x8fec5c, nMaxCount=1 | out: lpString="") returned 0 [0098.726] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0xd, wParam=0x1, lParam=0x8fec5c) returned 0x0 [0098.726] OleInitialize (pvReserved=0x0) returned 0x0 [0098.726] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x8fee7c | out: lplpMessageFilter=0x8fee7c*=0x0) returned 0x0 [0098.727] PeekMessageW (in: lpMsg=0x8fee50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x8fee50) returned 1 [0098.727] IsWindowUnicode (hWnd=0x6014c) returned 1 [0098.727] GetMessageW (in: lpMsg=0x8fee50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8fee50) returned 1 [0098.728] TranslateMessage (lpMsg=0x8fee50) returned 0 [0098.728] DispatchMessageW (lpMsg=0x8fee50) returned 0x0 [0098.728] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x46, wParam=0x0, lParam=0x8feba4) returned 0x0 [0098.728] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x83, wParam=0x1, lParam=0x8feb7c) returned 0x0 [0098.728] GetWindowPlacement (in: hWnd=0x6014c, lpwndpl=0x8fe8d0 | out: lpwndpl=0x8fe8d0) returned 1 [0098.728] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x47, wParam=0x0, lParam=0x8feba4) returned 0x0 [0098.728] GetClientRect (in: hWnd=0x6014c, lpRect=0x8fe880 | out: lpRect=0x8fe880) returned 1 [0098.728] GetWindowRect (in: hWnd=0x6014c, lpRect=0x8fe880 | out: lpRect=0x8fe880) returned 1 [0098.728] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0098.728] PeekMessageW (in: lpMsg=0x8fee50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x8fee50) returned 1 [0098.728] IsWindowUnicode (hWnd=0x6006a) returned 1 [0098.728] GetMessageW (in: lpMsg=0x8fee50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8fee50) returned 1 [0098.729] TranslateMessage (lpMsg=0x8fee50) returned 0 [0098.729] DispatchMessageW (lpMsg=0x8fee50) returned 0x0 [0098.729] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6006a, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0098.729] PeekMessageW (in: lpMsg=0x8fee50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x8fee50) returned 1 [0098.729] IsWindowUnicode (hWnd=0x6014c) returned 1 [0098.729] GetMessageW (in: lpMsg=0x8fee50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8fee50) returned 1 [0098.729] TranslateMessage (lpMsg=0x8fee50) returned 0 [0098.729] DispatchMessageW (lpMsg=0x8fee50) returned 0x0 [0098.729] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x46, wParam=0x0, lParam=0x8feba4) returned 0x0 [0098.729] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x83, wParam=0x1, lParam=0x8feb7c) returned 0x0 [0098.729] GetWindowPlacement (in: hWnd=0x6014c, lpwndpl=0x8fe8d0 | out: lpwndpl=0x8fe8d0) returned 1 [0098.731] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x47, wParam=0x0, lParam=0x8feba4) returned 0x0 [0098.731] GetClientRect (in: hWnd=0x6014c, lpRect=0x8fe880 | out: lpRect=0x8fe880) returned 1 [0098.731] GetWindowRect (in: hWnd=0x6014c, lpRect=0x8fe880 | out: lpRect=0x8fe880) returned 1 [0098.731] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x31f, wParam=0x0, lParam=0x0) returned 0x0 [0098.731] PeekMessageW (in: lpMsg=0x8fee50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x8fee50) returned 1 [0098.731] GetMessageA (in: lpMsg=0x8fee50, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8fee50) returned 0 [0098.736] DestroyCursor (hCursor=0x902a1) returned 1 [0098.746] GetWindowLongW (hWnd=0x6014c, nIndex=-20) returned 589824 [0098.746] DestroyWindow (hWnd=0x6014c) returned 1 [0098.746] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0098.746] PostThreadMessageW (idThread=0x1234, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0098.924] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0098.925] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6014c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0098.925] DestroyWindow (hWnd=0x6006a) returned 1 [0098.925] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6006a, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0098.925] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6006a, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0098.925] CallWindowProcW (lpPrevWndFunc=0x73f70140, hWnd=0x6006a, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0098.931] GetCurrentThreadId () returned 0x1234 [0098.931] EnumThreadWindows (dwThreadId=0x1234, lpfn=0x4cd06ae, lParam=0x0) returned 1 [0098.931] IsWindowVisible (hWnd=0x70044) returned 0 [0098.931] IsWindowVisible (hWnd=0x70048) returned 0 [0098.931] GetCurrentThreadId () returned 0x1234 [0098.931] GetCurrentThreadId () returned 0x1234 [0098.932] EnumThreadWindows (dwThreadId=0x1234, lpfn=0x4cd074e, lParam=0x0) returned 1 [0098.932] IsWindowVisible (hWnd=0x70044) returned 0 [0098.932] IsWindowVisible (hWnd=0x70048) returned 0 [0098.933] OleUninitialize () [0098.933] CloseHandle (hObject=0x2e4) returned 1 [0098.933] DeactivateActCtx (dwFlags=0x0, ulCookie=0x165a0002) returned 1 [0098.933] CoGetContextToken (in: pToken=0x8ff7f8 | out: pToken=0x8ff7f8) returned 0x0 [0098.933] CObjectContext::QueryInterface () returned 0x0 [0098.933] CObjectContext::GetCurrentThreadType () returned 0x0 [0098.933] Release () returned 0x0 [0098.934] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0xa7bf18*=0x198, lpdwindex=0x8ff69c | out: lpdwindex=0x8ff69c) returned 0x0 Thread: id = 2 os_tid = 0x10a0 Thread: id = 3 os_tid = 0x10ac Thread: id = 4 os_tid = 0x10b0 [0053.130] CoGetContextToken (in: pToken=0x47ff954 | out: pToken=0x47ff954) returned 0x800401f0 [0053.130] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0053.130] RoInitialize () returned 0x1 [0053.130] RoUninitialize () returned 0x0 [0061.574] CloseHandle (hObject=0x334) returned 1 [0061.575] CloseHandle (hObject=0x2cc) returned 1 [0061.575] CloseHandle (hObject=0x2c8) returned 1 [0061.575] CloseHandle (hObject=0xe4) returned 1 [0061.575] CloseHandle (hObject=0x2c0) returned 1 [0061.575] CloseHandle (hObject=0x2dc) returned 1 [0061.575] CloseHandle (hObject=0x2d8) returned 1 [0061.576] CloseHandle (hObject=0x2d4) returned 1 [0061.576] CloseHandle (hObject=0x2d0) returned 1 [0099.242] SetWindowLongW (hWnd=0x201cc, nIndex=-4, dwNewLong=1945567552) returned 80545294 [0099.243] SetClassLongW (hWnd=0x201cc, nIndex=-24, dwNewLong=1945567552) returned 0x4cd05e6 [0099.243] PostMessageW (hWnd=0x201cc, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0099.243] GetModuleHandleW (lpModuleName=0x0) returned 0x4c0000 [0099.243] UnregisterClassW (lpClassName="WindowsForms10.Window.0.app.0.141b42a_r9_ad1", hInstance=0x4c0000) returned 1 [0099.244] GetModuleHandleW (lpModuleName=0x0) returned 0x4c0000 [0099.244] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", hInstance=0x4c0000) returned 0 [0099.247] IsWindow (hWnd=0x70044) returned 1 [0099.248] GetModuleHandleW (lpModuleName="user32.dll") returned 0x77260000 [0099.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x47ff6f4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW\x9dqÁï\x13/ðùksxù\x7f\x04\x01", lpUsedDefaultChar=0x0) returned 14 [0099.248] GetProcAddress (hModule=0x77260000, lpProcName="DefWindowProcW") returned 0x73f70140 [0099.248] SetWindowLongW (hWnd=0x70044, nIndex=-4, dwNewLong=1945567552) returned 80545414 [0099.248] SetClassLongW (hWnd=0x70044, nIndex=-24, dwNewLong=1945567552) returned 0x4cd0686 [0099.249] IsWindow (hWnd=0x70044) returned 1 [0099.249] DestroyWindow (hWnd=0x70044) returned 0 [0099.249] PostMessageW (hWnd=0x70044, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0099.249] SetConsoleCtrlHandler (HandlerRoutine=0x4cd065e, Add=0) returned 1 [0099.249] EtwEventUnregister (RegHandle=0xae08a8) returned 0x0 [0099.255] CloseHandle (hObject=0x404) returned 1 [0099.256] CloseHandle (hObject=0x3f8) returned 1 [0099.256] CloseHandle (hObject=0x3e4) returned 1 [0099.256] GdipDeleteFont (font=0x4c3ef48) returned 0x0 [0099.256] DeleteObject (ho=0x2c0a04fe) returned 1 [0099.257] DestroyCursor (hCursor=0x50295) returned 1 [0099.257] CloseHandle (hObject=0x5e8) returned 1 [0099.257] CloseHandle (hObject=0x50c) returned 1 [0099.258] CloseHandle (hObject=0x61c) returned 1 [0099.258] CloseHandle (hObject=0x498) returned 1 [0099.258] CloseHandle (hObject=0x3fc) returned 1 [0099.258] UnmapViewOfFile (lpBaseAddress=0x4ca0000) returned 1 [0099.258] CloseHandle (hObject=0x624) returned 1 [0099.259] RegCloseKey (hKey=0x80000004) returned 0x0 [0099.260] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 5 os_tid = 0xe44 Thread: id = 6 os_tid = 0xfcc Thread: id = 7 os_tid = 0x6c8 Thread: id = 8 os_tid = 0x3b8 Thread: id = 9 os_tid = 0xec Thread: id = 12 os_tid = 0x6d4 Thread: id = 149 os_tid = 0xec0 Thread: id = 150 os_tid = 0xf08 Thread: id = 151 os_tid = 0xd60 Thread: id = 152 os_tid = 0xe5c Thread: id = 153 os_tid = 0xe14 Thread: id = 154 os_tid = 0xf40 Thread: id = 155 os_tid = 0xf88 Thread: id = 156 os_tid = 0x12ec Thread: id = 169 os_tid = 0x1094 Thread: id = 172 os_tid = 0xf50 Thread: id = 176 os_tid = 0x1388 Thread: id = 186 os_tid = 0x131c Thread: id = 196 os_tid = 0x134c Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2ad8f000" os_pid = "0x57c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x11e0" cmd_line = "\"cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 10 os_tid = 0x728 [0086.657] GetModuleHandleA (lpModuleName=0x0) returned 0xb90000 [0086.657] __set_app_type (_Type=0x1) [0086.657] __p__fmode () returned 0x747d3c14 [0086.657] __p__commode () returned 0x747d49ec [0086.658] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xba6fd0) returned 0x0 [0086.658] __getmainargs (in: _Argc=0xbbd1a4, _Argv=0xbbd1a8, _Env=0xbbd1ac, _DoWildCard=0, _StartInfo=0xbbd1b8 | out: _Argc=0xbbd1a4, _Argv=0xbbd1a8, _Env=0xbbd1ac) returned 0 [0086.658] _onexit (_Func=0xba8030) returned 0xba8030 [0086.658] _onexit (_Func=0xba8040) returned 0xba8040 [0086.658] _onexit (_Func=0xba8050) returned 0xba8050 [0086.658] _onexit (_Func=0xba8060) returned 0xba8060 [0086.658] _onexit (_Func=0xba8070) returned 0xba8070 [0086.659] _onexit (_Func=0xba8080) returned 0xba8080 [0086.659] GetCurrentThreadId () returned 0x728 [0086.659] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x728) returned 0xb0 [0086.659] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77190000 [0086.659] GetProcAddress (hModule=0x77190000, lpProcName="SetThreadUILanguage") returned 0x771a4f70 [0086.659] SetThreadUILanguage (LangId=0x0) returned 0x2df0409 [0086.707] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0086.707] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xb1f804 | out: phkResult=0xb1f804*=0x0) returned 0x2 [0086.707] VirtualQuery (in: lpAddress=0xb1f80f, lpBuffer=0xb1f7bc, dwLength=0x1c | out: lpBuffer=0xb1f7bc*(BaseAddress=0xb1f000, AllocationBase=0xa20000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0086.707] VirtualQuery (in: lpAddress=0xa20000, lpBuffer=0xb1f7bc, dwLength=0x1c | out: lpBuffer=0xb1f7bc*(BaseAddress=0xa20000, AllocationBase=0xa20000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0086.707] VirtualQuery (in: lpAddress=0xa21000, lpBuffer=0xb1f7bc, dwLength=0x1c | out: lpBuffer=0xb1f7bc*(BaseAddress=0xa21000, AllocationBase=0xa20000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0086.707] VirtualQuery (in: lpAddress=0xa23000, lpBuffer=0xb1f7bc, dwLength=0x1c | out: lpBuffer=0xb1f7bc*(BaseAddress=0xa23000, AllocationBase=0xa20000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0086.707] VirtualQuery (in: lpAddress=0xb20000, lpBuffer=0xb1f7bc, dwLength=0x1c | out: lpBuffer=0xb1f7bc*(BaseAddress=0xb20000, AllocationBase=0xb20000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0086.707] GetConsoleOutputCP () returned 0x1b5 [0086.784] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xbc3850 | out: lpCPInfo=0xbc3850) returned 1 [0086.784] SetConsoleCtrlHandler (HandlerRoutine=0xbb7260, Add=1) returned 1 [0086.784] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.784] GetConsoleMode (in: hConsoleHandle=0x3f4, lpMode=0xbc388c | out: lpMode=0xbc388c) returned 0 [0086.784] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.784] GetConsoleMode (in: hConsoleHandle=0xe4, lpMode=0xbc3888 | out: lpMode=0xbc3888) returned 0 [0086.784] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.784] SetConsoleMode (hConsoleHandle=0x3f4, dwMode=0x0) returned 0 [0086.784] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.784] GetConsoleMode (in: hConsoleHandle=0x3f4, lpMode=0xbc3890 | out: lpMode=0xbc3890) returned 0 [0086.784] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.784] GetConsoleMode (in: hConsoleHandle=0xe4, lpMode=0xbc3894 | out: lpMode=0xbc3894) returned 0 [0086.784] GetEnvironmentStringsW () returned 0x2ff4b10* [0086.784] GetProcessHeap () returned 0x2ff0000 [0086.784] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0xaca) returned 0x2ff55e8 [0086.785] FreeEnvironmentStringsA (penv="A") returned 1 [0086.785] GetProcessHeap () returned 0x2ff0000 [0086.785] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x4) returned 0x2ff45f0 [0086.785] GetEnvironmentStringsW () returned 0x2ff4b10* [0086.785] GetProcessHeap () returned 0x2ff0000 [0086.785] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0xaca) returned 0x2ff60c0 [0086.785] FreeEnvironmentStringsA (penv="A") returned 1 [0086.785] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xb1e760 | out: phkResult=0xb1e760*=0xc0) returned 0x0 [0086.785] RegQueryValueExW (in: hKey=0xc0, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x0, lpData=0xb1e76c*=0x0, lpcbData=0xb1e764*=0x1000) returned 0x2 [0086.785] RegQueryValueExW (in: hKey=0xc0, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x4, lpData=0xb1e76c*=0x1, lpcbData=0xb1e764*=0x4) returned 0x0 [0086.785] RegQueryValueExW (in: hKey=0xc0, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x0, lpData=0xb1e76c*=0x1, lpcbData=0xb1e764*=0x1000) returned 0x2 [0086.785] RegQueryValueExW (in: hKey=0xc0, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x4, lpData=0xb1e76c*=0x0, lpcbData=0xb1e764*=0x4) returned 0x0 [0086.785] RegQueryValueExW (in: hKey=0xc0, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x4, lpData=0xb1e76c*=0x40, lpcbData=0xb1e764*=0x4) returned 0x0 [0086.785] RegQueryValueExW (in: hKey=0xc0, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x4, lpData=0xb1e76c*=0x40, lpcbData=0xb1e764*=0x4) returned 0x0 [0086.785] RegQueryValueExW (in: hKey=0xc0, lpValueName="AutoRun", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x0, lpData=0xb1e76c*=0x40, lpcbData=0xb1e764*=0x1000) returned 0x2 [0086.785] RegCloseKey (hKey=0xc0) returned 0x0 [0086.785] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xb1e760 | out: phkResult=0xb1e760*=0xc0) returned 0x0 [0086.785] RegQueryValueExW (in: hKey=0xc0, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x0, lpData=0xb1e76c*=0x40, lpcbData=0xb1e764*=0x1000) returned 0x2 [0086.785] RegQueryValueExW (in: hKey=0xc0, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x4, lpData=0xb1e76c*=0x1, lpcbData=0xb1e764*=0x4) returned 0x0 [0086.785] RegQueryValueExW (in: hKey=0xc0, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x0, lpData=0xb1e76c*=0x1, lpcbData=0xb1e764*=0x1000) returned 0x2 [0086.786] RegQueryValueExW (in: hKey=0xc0, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x4, lpData=0xb1e76c*=0x0, lpcbData=0xb1e764*=0x4) returned 0x0 [0086.786] RegQueryValueExW (in: hKey=0xc0, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x4, lpData=0xb1e76c*=0x9, lpcbData=0xb1e764*=0x4) returned 0x0 [0086.786] RegQueryValueExW (in: hKey=0xc0, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x4, lpData=0xb1e76c*=0x9, lpcbData=0xb1e764*=0x4) returned 0x0 [0086.786] RegQueryValueExW (in: hKey=0xc0, lpValueName="AutoRun", lpReserved=0x0, lpType=0xb1e768, lpData=0xb1e76c, lpcbData=0xb1e764*=0x1000 | out: lpType=0xb1e768*=0x0, lpData=0xb1e76c*=0x9, lpcbData=0xb1e764*=0x1000) returned 0x2 [0086.786] RegCloseKey (hKey=0xc0) returned 0x0 [0086.786] time (in: timer=0x0 | out: timer=0x0) returned 0x5f8238b6 [0086.786] srand (_Seed=0x5f8238b6) [0086.786] GetCommandLineW () returned="\"cmd.exe\"" [0086.786] malloc (_Size=0x4000) returned 0x31821f0 [0086.786] GetCommandLineW () returned="\"cmd.exe\"" [0086.786] malloc (_Size=0xffce) returned 0x3190048 [0086.787] ??_V@YAXPAX@Z () returned 0xb1f744 [0086.787] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3190048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0086.788] malloc (_Size=0xffce) returned 0x31a0020 [0086.788] ??_V@YAXPAX@Z () returned 0xb1f518 [0086.788] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x31a0020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0086.788] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xbbf840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0086.788] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xbbf840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0086.788] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xbbf840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0086.788] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0086.788] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0086.788] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0086.788] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0086.788] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0086.788] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0086.788] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0086.789] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0086.789] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0086.789] GetProcessHeap () returned 0x2ff0000 [0086.789] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x2ff55e8) returned 1 [0086.789] GetEnvironmentStringsW () returned 0x2ff4b10* [0086.789] GetProcessHeap () returned 0x2ff0000 [0086.789] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0xae2) returned 0x2ff7688 [0086.789] FreeEnvironmentStringsA (penv="A") returned 1 [0086.789] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xbbf840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0086.789] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xbbf840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0086.789] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0086.789] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0086.789] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0086.789] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0086.789] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0086.789] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0086.789] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0086.789] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0086.789] malloc (_Size=0xffce) returned 0x31afff8 [0086.789] ??_V@YAXPAX@Z () returned 0xb1f2b0 [0086.790] GetProcessHeap () returned 0x2ff0000 [0086.790] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x38) returned 0x2ff0ae0 [0086.790] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x31afff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0086.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x31afff8, lpFilePart=0xb1f2fc | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xb1f2fc*="Desktop") returned 0x17 [0086.790] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0086.790] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xb1f080 | out: lpFindFileData=0xb1f080*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x2ff0b20 [0086.790] FindClose (in: hFindFile=0x2ff0b20 | out: hFindFile=0x2ff0b20) returned 1 [0086.790] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xb1f080 | out: lpFindFileData=0xb1f080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x2ff0b20 [0086.791] FindClose (in: hFindFile=0x2ff0b20 | out: hFindFile=0x2ff0b20) returned 1 [0086.791] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xb1f080 | out: lpFindFileData=0xb1f080*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x84da08aa, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x84da08aa, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x2ff0b20 [0086.791] FindClose (in: hFindFile=0x2ff0b20 | out: hFindFile=0x2ff0b20) returned 1 [0086.791] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0086.791] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0086.791] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0086.791] GetProcessHeap () returned 0x2ff0000 [0086.791] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x2ff7688) returned 1 [0086.791] GetEnvironmentStringsW () returned 0x2ff4b10* [0086.791] GetProcessHeap () returned 0x2ff0000 [0086.791] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0xb1a) returned 0x2ff6b98 [0086.791] FreeEnvironmentStringsA (penv="=") returned 1 [0086.791] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3190048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0086.791] GetProcessHeap () returned 0x2ff0000 [0086.791] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x2ff0ae0) returned 1 [0086.791] ??_V@YAXPAX@Z () returned 0x1 [0086.791] ??_V@YAXPAX@Z () returned 0x1 [0086.791] GetProcessHeap () returned 0x2ff0000 [0086.791] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x400e) returned 0x2ff8ca0 [0086.792] GetProcessHeap () returned 0x2ff0000 [0086.792] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x2ff8ca0) returned 1 [0086.792] GetConsoleOutputCP () returned 0x1b5 [0086.811] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xbc3850 | out: lpCPInfo=0xbc3850) returned 1 [0086.811] GetUserDefaultLCID () returned 0x409 [0086.811] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xbbf82c, cchData=8 | out: lpLCData=":") returned 2 [0086.811] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xb1f66c, cchData=128 | out: lpLCData="0") returned 2 [0086.811] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xb1f66c, cchData=128 | out: lpLCData="0") returned 2 [0086.811] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xb1f66c, cchData=128 | out: lpLCData="1") returned 2 [0086.811] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xbbf81c, cchData=8 | out: lpLCData="/") returned 2 [0086.811] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xbbf7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0086.811] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xbbf778, cchData=32 | out: lpLCData="Tue") returned 4 [0086.811] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xbbf738, cchData=32 | out: lpLCData="Wed") returned 4 [0086.811] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xbbf6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0086.811] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xbbf6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0086.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xbbf678, cchData=32 | out: lpLCData="Sat") returned 4 [0086.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xbbf638, cchData=32 | out: lpLCData="Sun") returned 4 [0086.812] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xbbf80c, cchData=8 | out: lpLCData=".") returned 2 [0086.812] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xbbf7f8, cchData=8 | out: lpLCData=",") returned 2 [0086.812] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0086.813] GetProcessHeap () returned 0x2ff0000 [0086.813] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x0, Size=0x20c) returned 0x2ff7708 [0086.813] GetConsoleTitleW (in: lpConsoleTitle=0x2ff7708, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c [0086.813] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.813] GetFileType (hFile=0x3f4) returned 0x3 [0086.813] ApiSetQueryApiSetPresence () returned 0x0 [0086.813] ResolveDelayLoadedAPI () returned 0x6f29c640 [0086.905] BrandingFormatString () returned 0x2ff8078 [0086.910] GetVersion () returned 0x3ad7000a [0086.910] _vsnwprintf (in: _Buffer=0xb1f7a0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xb1f764 | out: _Buffer="10.0.15063") returned 10 [0086.911] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.911] GetFileType (hFile=0x3f4) returned 0x3 [0086.911] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0xbcb990, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0086.917] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0xbcb990, nSize=0x2000, Arguments=0xb1f760 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0086.917] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.917] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0xbbd630, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0086.917] WriteFile (in: hFile=0x3f4, lpBuffer=0xbbd630*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xb1f6f8, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesWritten=0xb1f6f8*=0x26, lpOverlapped=0x0) returned 1 [0086.917] _vsnwprintf (in: _Buffer=0xbcb990, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb1f76c | out: _Buffer="\r\n") returned 2 [0086.917] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.917] GetFileType (hFile=0x3f4) returned 0x3 [0086.917] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.917] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0xbbd630, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0086.917] WriteFile (in: hFile=0x3f4, lpBuffer=0xbbd630*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb1f75c, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesWritten=0xb1f75c*=0x2, lpOverlapped=0x0) returned 1 [0086.917] _vsnwprintf (in: _Buffer=0xbcb990, _BufferCount=0x1fff, _Format="%s", _ArgList=0xb1f774 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0086.917] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.917] GetFileType (hFile=0x3f4) returned 0x3 [0086.917] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.917] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0xbbd630, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0086.917] WriteFile (in: hFile=0x3f4, lpBuffer=0xbbd630*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xb1f764, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesWritten=0xb1f764*=0x34, lpOverlapped=0x0) returned 1 [0086.917] _vsnwprintf (in: _Buffer=0xbcb990, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb1f770 | out: _Buffer="\r\n") returned 2 [0086.917] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.917] GetFileType (hFile=0x3f4) returned 0x3 [0086.917] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.917] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0xbbd630, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0086.917] WriteFile (in: hFile=0x3f4, lpBuffer=0xbbd630*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb1f760, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesWritten=0xb1f760*=0x2, lpOverlapped=0x0) returned 1 [0086.918] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77190000 [0086.918] GetProcAddress (hModule=0x77190000, lpProcName="CopyFileExW") returned 0x771a4330 [0086.918] GetProcAddress (hModule=0x77190000, lpProcName="IsDebuggerPresent") returned 0x771a5930 [0086.918] GetProcAddress (hModule=0x77190000, lpProcName="SetConsoleInputExeNameW") returned 0x746209d0 [0086.918] ??_V@YAXPAX@Z () returned 0x1 [0086.918] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.918] GetFileType (hFile=0xe4) returned 0x3 [0086.918] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0086.918] NtOpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xb1f598 | out: TokenHandle=0xb1f598*=0x0) returned 0xc000007c [0086.918] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xb1f598 | out: TokenHandle=0xb1f598*=0xdc) returned 0x0 [0086.918] NtQueryInformationToken (in: TokenHandle=0xdc, TokenInformationClass=0x12, TokenInformation=0xb1f574, TokenInformationLength=0x4, ReturnLength=0xb1f570 | out: TokenInformation=0xb1f574, ReturnLength=0xb1f570) returned 0x0 [0086.918] NtQueryInformationToken (in: TokenHandle=0xdc, TokenInformationClass=0x1a, TokenInformation=0xb1f574, TokenInformationLength=0x4, ReturnLength=0xb1f578 | out: TokenInformation=0xb1f574, ReturnLength=0xb1f578) returned 0x0 [0086.918] NtClose (Handle=0xdc) returned 0x0 [0086.918] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xb1f594, nSize=0x0, Arguments=0xb1f590 | out: lpBuffer="絸˿±忋¹❈䀀ÿ") returned 0xf [0086.920] GetProcessHeap () returned 0x2ff0000 [0086.920] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x210) returned 0x2ff0de8 [0086.920] GetConsoleTitleW (in: lpConsoleTitle=0xb1f5cc, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c [0086.922] wcsstr (_Str="C:\\WINDOWS\\SYSTEM32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0086.922] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 1 [0086.922] GetProcessHeap () returned 0x2ff0000 [0086.922] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x2ff0de8) returned 1 [0086.922] LocalFree (hMem=0x2ff7d78) returned 0x0 [0086.922] _vsnwprintf (in: _Buffer=0xbcb990, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb1f4a0 | out: _Buffer="\r\n") returned 2 [0086.922] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.922] GetFileType (hFile=0x3f4) returned 0x3 [0086.922] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.922] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0xbbd630, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0086.922] WriteFile (in: hFile=0x3f4, lpBuffer=0xbbd630*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb1f490, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesWritten=0xb1f490*=0x2, lpOverlapped=0x0) returned 1 [0086.922] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xbbf840, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0086.923] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3190048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0086.923] malloc (_Size=0x107ce) returned 0x31a2648 [0086.923] _vsnwprintf (in: _Buffer=0x31a2648, _BufferCount=0x83e5, _Format="%s", _ArgList=0xb1f49c | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0086.923] _vsnwprintf (in: _Buffer=0x31a2676, _BufferCount=0x83ce, _Format="%c", _ArgList=0xb1f49c | out: _Buffer=">") returned 1 [0086.923] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.923] GetFileType (hFile=0x3f4) returned 0x3 [0086.923] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.923] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0xbbd630, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0086.923] WriteFile (in: hFile=0x3f4, lpBuffer=0xbbd630*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xb1f494, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesWritten=0xb1f494*=0x18, lpOverlapped=0x0) returned 1 [0086.923] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.923] GetFileType (hFile=0xe4) returned 0x3 [0086.923] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.923] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.923] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.923] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78b0, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0086.923] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.923] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.924] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.924] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78b2, cchWideChar=1 | out: lpWideCharStr=":") returned 1 [0086.924] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.924] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.924] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.924] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78b4, cchWideChar=1 | out: lpWideCharStr="\\") returned 1 [0086.924] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.924] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.924] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.924] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78b6, cchWideChar=1 | out: lpWideCharStr="W") returned 1 [0086.924] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.924] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.924] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.924] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78b8, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0086.924] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.924] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.924] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.924] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78ba, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0086.924] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.924] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.924] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.924] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78bc, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0086.924] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.924] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.924] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.924] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78be, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0086.925] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.925] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.925] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.925] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78c0, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0086.925] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.925] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.925] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.925] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78c2, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0086.925] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.925] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.925] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.925] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78c4, cchWideChar=1 | out: lpWideCharStr="\\") returned 1 [0086.925] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.925] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.925] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.925] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78c6, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0086.925] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.925] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.925] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.925] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78c8, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0086.925] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.925] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.925] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.925] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78ca, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0086.925] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.925] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.925] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.925] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78cc, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0086.926] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.926] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.926] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78ce, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0086.926] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.926] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.926] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78d0, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0086.926] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.926] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.926] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78d2, cchWideChar=1 | out: lpWideCharStr="3") returned 1 [0086.926] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.926] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.926] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78d4, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0086.926] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.926] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.926] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78d6, cchWideChar=1 | out: lpWideCharStr="\\") returned 1 [0086.926] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.926] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.926] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78d8, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0086.929] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.929] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.929] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78da, cchWideChar=1 | out: lpWideCharStr="b") returned 1 [0086.929] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.929] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.929] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78dc, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0086.929] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.929] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.929] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78de, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0086.929] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.929] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.929] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78e0, cchWideChar=1 | out: lpWideCharStr="\\") returned 1 [0086.929] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.929] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.929] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78e2, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0086.930] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.930] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.930] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78e4, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0086.930] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.930] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.930] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78e6, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0086.930] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.930] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.930] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78e8, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0086.930] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.930] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.930] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78ea, cchWideChar=1 | out: lpWideCharStr=".") returned 1 [0086.930] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.930] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.930] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78ec, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0086.930] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.930] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.930] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78ee, cchWideChar=1 | out: lpWideCharStr="x") returned 1 [0086.930] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.930] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.930] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78f0, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0086.930] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.930] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.930] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.930] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78f2, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0086.931] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.931] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.931] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78f4, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0086.931] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.931] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.931] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78f6, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0086.931] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.931] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.931] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78f8, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0086.931] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.931] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.931] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78fa, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0086.931] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.931] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.931] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78fc, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0086.931] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.931] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.931] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc78fe, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0086.931] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.931] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.931] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.931] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc7900, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0086.931] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.931] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.931] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc7902, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0086.932] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.932] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.932] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc7904, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0086.932] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.932] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.932] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc7906, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0086.932] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.932] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.932] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc7908, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0086.932] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.932] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.932] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc790a, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0086.932] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.932] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.932] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc790c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0086.932] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.932] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.932] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.932] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc790e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0086.932] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.932] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.932] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc7910, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0086.933] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.933] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.933] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc7912, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0086.933] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.933] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.933] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc7914, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0086.933] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.933] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.933] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc7916, cchWideChar=1 | out: lpWideCharStr="&") returned 1 [0086.933] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.933] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.933] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc7918, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0086.933] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.933] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.933] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc791a, cchWideChar=1 | out: lpWideCharStr="x") returned 1 [0086.933] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.933] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.933] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.933] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc791c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0086.933] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.933] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.934] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc791e, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0086.934] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.934] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.934] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc7920, cchWideChar=1 | out: lpWideCharStr="\r") returned 1 [0086.934] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.934] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.934] ReadFile (in: hFile=0xe4, lpBuffer=0xbbd630, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1f770, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesRead=0xb1f770*=0x1, lpOverlapped=0x0) returned 1 [0086.934] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0xbbd630, cbMultiByte=1, lpWideCharStr=0xbc7922, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0086.935] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.935] GetFileType (hFile=0xe4) returned 0x3 [0086.935] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.935] SetFilePointer (in: hFile=0xe4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.935] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.935] GetFileType (hFile=0x3f4) returned 0x3 [0086.935] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.935] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete&exit\r\n", cchWideChar=-1, lpMultiByteStr=0xbbd630, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete&exit\r\n", lpUsedDefaultChar=0x0) returned 59 [0086.935] WriteFile (in: hFile=0x3f4, lpBuffer=0xbbd630*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0xb1f74c, lpOverlapped=0x0 | out: lpBuffer=0xbbd630*, lpNumberOfBytesWritten=0xb1f74c*=0x3a, lpOverlapped=0x0) returned 1 [0086.935] GetProcessHeap () returned 0x2ff0000 [0086.935] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x400a) returned 0x2ffabc0 [0086.935] GetProcessHeap () returned 0x2ff0000 [0086.935] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x2ffabc0) returned 1 [0086.937] _wcsicmp (_String1="C:\\Windows\\system32\\wbem\\wmic.exe", _String2=")") returned 58 [0086.937] _wcsicmp (_String1="FOR", _String2="C:\\Windows\\system32\\wbem\\wmic.exe") returned 3 [0086.937] _wcsicmp (_String1="FOR/?", _String2="C:\\Windows\\system32\\wbem\\wmic.exe") returned 3 [0086.937] _wcsicmp (_String1="IF", _String2="C:\\Windows\\system32\\wbem\\wmic.exe") returned 6 [0086.937] _wcsicmp (_String1="IF/?", _String2="C:\\Windows\\system32\\wbem\\wmic.exe") returned 6 [0086.937] _wcsicmp (_String1="REM", _String2="C:\\Windows\\system32\\wbem\\wmic.exe") returned 15 [0086.937] _wcsicmp (_String1="REM/?", _String2="C:\\Windows\\system32\\wbem\\wmic.exe") returned 15 [0086.937] GetProcessHeap () returned 0x2ff0000 [0086.937] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x58) returned 0x2ff7920 [0086.937] GetProcessHeap () returned 0x2ff0000 [0086.937] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x4c) returned 0x2ff7b00 [0086.937] GetProcessHeap () returned 0x2ff0000 [0086.937] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x2e) returned 0x2ff6028 [0086.937] GetProcessHeap () returned 0x2ff0000 [0086.937] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x58) returned 0x2ff6060 [0086.938] _wcsicmp (_String1="exit", _String2=")") returned 60 [0086.938] _wcsicmp (_String1="FOR", _String2="exit") returned 1 [0086.938] _wcsicmp (_String1="FOR/?", _String2="exit") returned 1 [0086.938] _wcsicmp (_String1="IF", _String2="exit") returned 4 [0086.938] _wcsicmp (_String1="IF/?", _String2="exit") returned 4 [0086.938] _wcsicmp (_String1="REM", _String2="exit") returned 13 [0086.938] _wcsicmp (_String1="REM/?", _String2="exit") returned 13 [0086.938] GetProcessHeap () returned 0x2ff0000 [0086.938] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x58) returned 0x2ff7d78 [0086.938] GetProcessHeap () returned 0x2ff0000 [0086.938] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x12) returned 0x2ff7dd8 [0086.938] GetConsoleOutputCP () returned 0x1b5 [0086.939] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xbc3850 | out: lpCPInfo=0xbc3850) returned 1 [0086.939] SetThreadUILanguage (LangId=0x0) returned 0x2df0409 [0086.939] GetConsoleTitleW (in: lpConsoleTitle=0xb1f500, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x2b [0086.939] malloc (_Size=0xffce) returned 0x31b2e20 [0086.939] ??_V@YAXPAX@Z () returned 0xb1f28c [0086.940] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.940] malloc (_Size=0xffce) returned 0x31c2df8 [0086.940] ??_V@YAXPAX@Z () returned 0xb1f044 [0086.940] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.940] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x31c2df8, nVolumeNameSize=0x7fe7, lpVolumeSerialNumber=0xb1f088, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0xb1f088*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0086.944] ??_V@YAXPAX@Z () returned 0x1 [0086.944] GetProcessHeap () returned 0x2ff0000 [0086.944] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0xffd6) returned 0x2ffabc0 [0086.945] GetProcessHeap () returned 0x2ff0000 [0086.945] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x72) returned 0x2ff8078 [0086.945] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51 [0086.945] malloc (_Size=0xffce) returned 0x31c2df8 [0086.945] ??_V@YAXPAX@Z () returned 0xb1edc4 [0086.946] GetProcessHeap () returned 0x2ff0000 [0086.946] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x1ffa4) returned 0x300aba0 [0086.947] SetErrorMode (uMode=0x0) returned 0x0 [0086.947] SetErrorMode (uMode=0x1) returned 0x0 [0086.947] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wbem\\.", nBufferLength=0xffce, lpBuffer=0x300aba8, lpFilePart=0xb1ede4 | out: lpBuffer="C:\\Windows\\system32\\wbem", lpFilePart=0xb1ede4*="wbem") returned 0x18 [0086.947] SetErrorMode (uMode=0x0) returned 0x1 [0086.947] GetProcessHeap () returned 0x2ff0000 [0086.947] RtlReAllocateHeap (Heap=0x2ff0000, Flags=0x0, Ptr=0x300aba0, Size=0x4c) returned 0x300aba0 [0086.947] GetProcessHeap () returned 0x2ff0000 [0086.947] RtlSizeHeap (HeapHandle=0x2ff0000, Flags=0x0, MemoryPointer=0x300aba0) returned 0x4c [0086.947] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\wbem\\.") returned 1 [0086.947] GetProcessHeap () returned 0x2ff0000 [0086.947] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x40) returned 0x2ff80f8 [0086.947] GetProcessHeap () returned 0x2ff0000 [0086.947] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x74) returned 0x2ff04a0 [0086.947] GetProcessHeap () returned 0x2ff0000 [0086.947] RtlReAllocateHeap (Heap=0x2ff0000, Flags=0x0, Ptr=0x2ff04a0, Size=0x40) returned 0x2ff04a0 [0086.947] GetProcessHeap () returned 0x2ff0000 [0086.947] RtlSizeHeap (HeapHandle=0x2ff0000, Flags=0x0, MemoryPointer=0x2ff04a0) returned 0x40 [0086.947] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xbbf840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0086.947] GetProcessHeap () returned 0x2ff0000 [0086.947] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0xe0) returned 0x2ff13f0 [0086.950] GetProcessHeap () returned 0x2ff0000 [0086.950] RtlReAllocateHeap (Heap=0x2ff0000, Flags=0x0, Ptr=0x2ff13f0, Size=0x76) returned 0x2ff13f0 [0086.950] GetProcessHeap () returned 0x2ff0000 [0086.950] RtlSizeHeap (HeapHandle=0x2ff0000, Flags=0x0, MemoryPointer=0x2ff13f0) returned 0x76 [0086.950] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.950] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbem\\wmic.exe", fInfoLevelId=0x1, lpFindFileData=0xb1eb90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb1eb90) returned 0x2ff04e8 [0086.960] GetProcessHeap () returned 0x2ff0000 [0086.960] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x0, Size=0x14) returned 0x2ff7df8 [0086.960] FindClose (in: hFindFile=0x2ff04e8 | out: hFindFile=0x2ff04e8) returned 1 [0086.960] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0086.960] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0086.960] ??_V@YAXPAX@Z () returned 0x1 [0086.961] GetConsoleTitleW (in: lpConsoleTitle=0xb1f074, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x2b [0086.961] GetProcessHeap () returned 0x2ff0000 [0086.961] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x214) returned 0x300b400 [0086.961] GetConsoleTitleW (in: lpConsoleTitle=0x300b408, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x2b [0086.962] GetProcessHeap () returned 0x2ff0000 [0086.962] RtlReAllocateHeap (Heap=0x2ff0000, Flags=0x0, Ptr=0x300b400, Size=0xda) returned 0x300b400 [0086.962] GetProcessHeap () returned 0x2ff0000 [0086.962] RtlSizeHeap (HeapHandle=0x2ff0000, Flags=0x0, MemoryPointer=0x300b400) returned 0xda [0086.962] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\SYSTEM32\\cmd.exe - C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete") returned 1 [0086.962] GetProcessHeap () returned 0x2ff0000 [0086.962] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x300b400) returned 1 [0086.962] InitializeProcThreadAttributeList (in: lpAttributeList=0xb1efa0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xb1ef8c | out: lpAttributeList=0xb1efa0, lpSize=0xb1ef8c) returned 1 [0086.962] UpdateProcThreadAttribute (in: lpAttributeList=0xb1efa0, dwFlags=0x0, Attribute=0x60001, lpValue=0xb1ef88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xb1efa0, lpPreviousValue=0x0) returned 1 [0086.962] GetStartupInfoW (in: lpStartupInfo=0xb1efd8 | out: lpStartupInfo=0xb1efd8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe4, hStdOutput=0x3f4, hStdError=0x3fc)) [0086.962] GetProcessHeap () returned 0x2ff0000 [0086.962] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x18) returned 0x2ff8140 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0086.962] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0086.963] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0086.963] GetProcessHeap () returned 0x2ff0000 [0086.963] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x2ff8140) returned 1 [0086.963] GetProcessHeap () returned 0x2ff0000 [0086.963] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0xa) returned 0x2ff0f60 [0086.963] _get_osfhandle (_FileHandle=1) returned 0x3f4 [0086.963] SetConsoleMode (hConsoleHandle=0x3f4, dwMode=0x0) returned 0 [0086.963] _get_osfhandle (_FileHandle=0) returned 0xe4 [0086.963] SetConsoleMode (hConsoleHandle=0xe4, dwMode=0x0) returned 0 [0086.963] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\wbem\\WMIC.exe", lpCommandLine="C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xb1ef28*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb1ef74 | out: lpCommandLine="C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete", lpProcessInformation=0xb1ef74*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xf54, dwThreadId=0x1284)) returned 1 [0087.185] CloseHandle (hObject=0xdc) returned 1 [0087.185] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0087.185] GetProcessHeap () returned 0x2ff0000 [0087.185] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x2ff6b98) returned 1 [0087.185] GetEnvironmentStringsW () returned 0x2ff6b98* [0087.185] GetProcessHeap () returned 0x2ff0000 [0087.185] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0xb1a) returned 0x300b400 [0087.185] FreeEnvironmentStringsA (penv="=") returned 1 [0087.185] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x77520000 [0087.185] GetProcAddress (hModule=0x77520000, lpProcName="NtQueryInformationProcess") returned 0x77591e80 [0087.185] NtQueryInformationProcess (in: ProcessHandle=0xe0, ProcessInformationClass=0x0, ProcessInformation=0xb1e848, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0xb1e848, ReturnLength=0x0) returned 0x0 [0087.185] ReadProcessMemory (in: hProcess=0xe0, lpBaseAddress=0x24c7000, lpBuffer=0xb1e870, nSize=0x460, lpNumberOfBytesRead=0xb1e860 | out: lpBuffer=0xb1e870*, lpNumberOfBytesRead=0xb1e860*=0x460) returned 1 [0087.185] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0092.293] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0xb1ef0c | out: lpExitCode=0xb1ef0c*=0x80041014) returned 1 [0092.293] CloseHandle (hObject=0xe0) returned 1 [0092.293] _vsnwprintf (in: _Buffer=0xb1eff4, _BufferCount=0x13, _Format="%08X", _ArgList=0xb1ef14 | out: _Buffer="80041014") returned 8 [0092.293] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1 [0092.293] GetProcessHeap () returned 0x2ff0000 [0092.293] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x300b400) returned 1 [0092.293] GetEnvironmentStringsW () returned 0x2ff8140* [0092.293] GetProcessHeap () returned 0x2ff0000 [0092.293] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0xb40) returned 0x300ca70 [0092.294] FreeEnvironmentStringsA (penv="=") returned 1 [0092.294] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0092.294] GetProcessHeap () returned 0x2ff0000 [0092.294] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x300ca70) returned 1 [0092.294] GetEnvironmentStringsW () returned 0x2ff8140* [0092.294] GetProcessHeap () returned 0x2ff0000 [0092.294] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0xb40) returned 0x300ca70 [0092.295] FreeEnvironmentStringsA (penv="=") returned 1 [0092.295] GetProcessHeap () returned 0x2ff0000 [0092.295] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x2ff0f60) returned 1 [0092.295] DeleteProcThreadAttributeList (in: lpAttributeList=0xb1efa0 | out: lpAttributeList=0xb1efa0) [0092.295] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 1 [0092.316] ??_V@YAXPAX@Z () returned 0x1 [0092.316] GetConsoleTitleW (in: lpConsoleTitle=0xb1f500, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x2b [0092.323] malloc (_Size=0xffce) returned 0x31b2e20 [0092.323] ??_V@YAXPAX@Z () returned 0xb1f28c [0092.323] malloc (_Size=0xffce) returned 0x31c2df8 [0092.323] ??_V@YAXPAX@Z () returned 0xb1f044 [0092.323] _wcsicmp (_String1="exit", _String2="DIR") returned 1 [0092.323] _wcsicmp (_String1="exit", _String2="ERASE") returned 6 [0092.323] _wcsicmp (_String1="exit", _String2="DEL") returned 1 [0092.323] _wcsicmp (_String1="exit", _String2="TYPE") returned -15 [0092.323] _wcsicmp (_String1="exit", _String2="COPY") returned 2 [0092.324] _wcsicmp (_String1="exit", _String2="CD") returned 2 [0092.324] _wcsicmp (_String1="exit", _String2="CHDIR") returned 2 [0092.324] _wcsicmp (_String1="exit", _String2="RENAME") returned -13 [0092.324] _wcsicmp (_String1="exit", _String2="REN") returned -13 [0092.324] _wcsicmp (_String1="exit", _String2="ECHO") returned 21 [0092.324] _wcsicmp (_String1="exit", _String2="SET") returned -14 [0092.324] _wcsicmp (_String1="exit", _String2="PAUSE") returned -11 [0092.324] _wcsicmp (_String1="exit", _String2="DATE") returned 1 [0092.324] _wcsicmp (_String1="exit", _String2="TIME") returned -15 [0092.324] _wcsicmp (_String1="exit", _String2="PROMPT") returned -11 [0092.324] _wcsicmp (_String1="exit", _String2="MD") returned -8 [0092.324] _wcsicmp (_String1="exit", _String2="MKDIR") returned -8 [0092.324] _wcsicmp (_String1="exit", _String2="RD") returned -13 [0092.324] _wcsicmp (_String1="exit", _String2="RMDIR") returned -13 [0092.324] _wcsicmp (_String1="exit", _String2="PATH") returned -11 [0092.324] _wcsicmp (_String1="exit", _String2="GOTO") returned -2 [0092.324] _wcsicmp (_String1="exit", _String2="SHIFT") returned -14 [0092.324] _wcsicmp (_String1="exit", _String2="CLS") returned 2 [0092.324] _wcsicmp (_String1="exit", _String2="CALL") returned 2 [0092.324] _wcsicmp (_String1="exit", _String2="VERIFY") returned -17 [0092.324] _wcsicmp (_String1="exit", _String2="VER") returned -17 [0092.324] _wcsicmp (_String1="exit", _String2="VOL") returned -17 [0092.324] _wcsicmp (_String1="exit", _String2="EXIT") returned 0 [0092.324] ??_V@YAXPAX@Z () returned 0x1 [0092.324] GetProcessHeap () returned 0x2ff0000 [0092.324] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0xc) returned 0x2ff0ed0 [0092.324] GetProcessHeap () returned 0x2ff0000 [0092.324] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x12) returned 0x2ff0578 [0092.324] GetProcessHeap () returned 0x2ff0000 [0092.324] RtlAllocateHeap (HeapHandle=0x2ff0000, Flags=0x8, Size=0x214) returned 0x300b400 [0092.324] GetConsoleTitleW (in: lpConsoleTitle=0x300b408, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x2b [0092.330] GetProcessHeap () returned 0x2ff0000 [0092.330] RtlReAllocateHeap (Heap=0x2ff0000, Flags=0x0, Ptr=0x300b400, Size=0x7a) returned 0x300b400 [0092.330] GetProcessHeap () returned 0x2ff0000 [0092.330] RtlSizeHeap (HeapHandle=0x2ff0000, Flags=0x0, MemoryPointer=0x300b400) returned 0x7a [0092.330] SetConsoleTitleW (lpConsoleTitle="exit") returned 1 [0092.337] GetProcessHeap () returned 0x2ff0000 [0092.337] RtlFreeHeap (HeapHandle=0x2ff0000, Flags=0x0, BaseAddress=0x300b400) returned 1 [0092.337] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 1 [0092.344] exit (_Code=-2147217388) [0092.344] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 15 os_tid = 0xda0 Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x227d1000" os_pid = "0x708" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x57c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 11 os_tid = 0xba8 Thread: id = 13 os_tid = 0xed0 Thread: id = 14 os_tid = 0x3f0 Process: id = "4" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x20856000" os_pid = "0xf54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x57c" cmd_line = "C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 16 os_tid = 0x1284 [0087.392] GetModuleHandleA (lpModuleName=0x0) returned 0x130000 [0087.392] __set_app_type (_Type=0x1) [0087.392] __p__fmode () returned 0x747d3c14 [0087.392] __p__commode () returned 0x747d49ec [0087.392] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x169af0) returned 0x0 [0087.392] __wgetmainargs (in: _Argc=0x1781a8, _Argv=0x1781ac, _Env=0x1781b0, _DoWildCard=0, _StartInfo=0x1781bc | out: _Argc=0x1781a8, _Argv=0x1781ac, _Env=0x1781b0) returned 0 [0087.392] ??0CHString@@QAE@XZ () returned 0x1785ec [0087.392] malloc (_Size=0x18) returned 0x29e0ef8 [0087.392] malloc (_Size=0x38) returned 0x29e0f18 [0087.392] malloc (_Size=0x28) returned 0x29e0f58 [0087.392] malloc (_Size=0x18) returned 0x29e0f88 [0087.392] malloc (_Size=0x24) returned 0x29e0fa8 [0087.393] malloc (_Size=0x18) returned 0x29e0fd8 [0087.393] malloc (_Size=0x18) returned 0x29e0ff8 [0087.393] ??0CHString@@QAE@XZ () returned 0x1788fc [0087.393] malloc (_Size=0x18) returned 0x29e1018 [0087.393] ?Empty@CHString@@QAEXXZ () returned 0x6f2565f8 [0087.393] SetConsoleCtrlHandler (HandlerRoutine=0x163cc0, Add=1) returned 1 [0087.393] _onexit (_Func=0x16f370) returned 0x16f370 [0087.393] _onexit (_Func=0x16f380) returned 0x16f380 [0087.393] _onexit (_Func=0x16f390) returned 0x16f390 [0087.393] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0087.393] ResolveDelayLoadedAPI () returned 0x755e2590 [0087.393] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0087.397] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0087.425] CoCreateInstance (in: rclsid=0x136a74*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x136a84*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x178510 | out: ppv=0x178510*=0x2a03708) returned 0x0 [0088.234] GetCurrentProcess () returned 0xffffffff [0088.234] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x267fce4 | out: TokenHandle=0x267fce4*=0x198) returned 1 [0088.234] GetTokenInformation (in: TokenHandle=0x198, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x267fce0 | out: TokenInformation=0x0, ReturnLength=0x267fce0) returned 0 [0088.234] malloc (_Size=0x118) returned 0x29e25d0 [0088.234] GetTokenInformation (in: TokenHandle=0x198, TokenInformationClass=0x3, TokenInformation=0x29e25d0, TokenInformationLength=0x118, ReturnLength=0x267fce0 | out: TokenInformation=0x29e25d0, ReturnLength=0x267fce0) returned 1 [0088.234] AdjustTokenPrivileges (in: TokenHandle=0x198, DisableAllPrivileges=0, NewState=0x29e25d0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0088.234] free (_Block=0x29e25d0) [0088.234] CloseHandle (hObject=0x198) returned 1 [0088.234] malloc (_Size=0x40) returned 0x29e25d0 [0088.234] malloc (_Size=0x40) returned 0x29e2618 [0088.235] malloc (_Size=0x40) returned 0x29e2660 [0088.235] SetThreadUILanguage (LangId=0x0) returned 0x24c0409 [0088.251] _vsnwprintf (in: _Buffer=0x29e2660, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x267fc6c | out: _Buffer="ms_409") returned 6 [0088.251] malloc (_Size=0x20) returned 0x29e26a8 [0088.251] GetComputerNameW (in: lpBuffer=0x29e26a8, nSize=0x267fcd0 | out: lpBuffer="NQDPDE", nSize=0x267fcd0) returned 1 [0088.251] lstrlenW (lpString="NQDPDE") returned 6 [0088.251] malloc (_Size=0xe) returned 0x29e11c8 [0088.251] lstrlenW (lpString="NQDPDE") returned 6 [0088.251] ResolveDelayLoadedAPI () returned 0x73ffdb00 [0088.251] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x267fce4 | out: lpNameBuffer=0x0, nSize=0x267fce4) returned 0x24ca000 [0088.252] GetLastError () returned 0xea [0088.252] malloc (_Size=0x1e) returned 0x29e26d0 [0088.252] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x29e26d0, nSize=0x267fce4 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x267fce4) returned 0x1 [0088.253] lstrlenW (lpString="") returned 0 [0088.253] lstrlenW (lpString="NQDPDE") returned 6 [0088.253] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0088.254] lstrlenW (lpString=".") returned 1 [0088.254] lstrlenW (lpString="NQDPDE") returned 6 [0088.254] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2=".", cchCount2=1) returned 3 [0088.254] lstrlenW (lpString="LOCALHOST") returned 9 [0088.254] lstrlenW (lpString="NQDPDE") returned 6 [0088.254] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="LOCALHOST", cchCount2=9) returned 3 [0088.254] lstrlenW (lpString="NQDPDE") returned 6 [0088.254] lstrlenW (lpString="NQDPDE") returned 6 [0088.254] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="NQDPDE", cchCount2=6) returned 2 [0088.254] free (_Block=0x29e11c8) [0088.254] lstrlenW (lpString="NQDPDE") returned 6 [0088.254] malloc (_Size=0xe) returned 0x29e11c8 [0088.254] lstrlenW (lpString="NQDPDE") returned 6 [0088.254] lstrlenW (lpString="NQDPDE") returned 6 [0088.254] malloc (_Size=0xe) returned 0x29e26f8 [0088.254] lstrlenW (lpString="NQDPDE") returned 6 [0088.254] malloc (_Size=0x4) returned 0x29e2710 [0088.254] malloc (_Size=0xc) returned 0x29e2720 [0088.254] ResolveDelayLoadedAPI () returned 0x7709b870 [0088.266] malloc (_Size=0x18) returned 0x29e2738 [0088.266] malloc (_Size=0xc) returned 0x29e2758 [0088.266] SysStringLen (param_1="IDENTIFY") returned 0x8 [0088.266] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0088.266] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0088.266] SysStringLen (param_1="IDENTIFY") returned 0x8 [0088.266] malloc (_Size=0x18) returned 0x29e2770 [0088.266] malloc (_Size=0xc) returned 0x29e2790 [0088.266] SysStringLen (param_1="IMPERSONATE") returned 0xb [0088.266] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0088.266] SysStringLen (param_1="IMPERSONATE") returned 0xb [0088.266] SysStringLen (param_1="IDENTIFY") returned 0x8 [0088.266] SysStringLen (param_1="IDENTIFY") returned 0x8 [0088.266] SysStringLen (param_1="IMPERSONATE") returned 0xb [0088.266] malloc (_Size=0x18) returned 0x29e27a8 [0088.266] malloc (_Size=0xc) returned 0x29e27c8 [0088.266] SysStringLen (param_1="DELEGATE") returned 0x8 [0088.267] SysStringLen (param_1="IDENTIFY") returned 0x8 [0088.267] SysStringLen (param_1="DELEGATE") returned 0x8 [0088.267] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0088.267] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0088.267] SysStringLen (param_1="DELEGATE") returned 0x8 [0088.267] malloc (_Size=0x18) returned 0x29e27e0 [0088.267] malloc (_Size=0xc) returned 0x29e2800 [0088.267] malloc (_Size=0x18) returned 0x29e2818 [0088.267] malloc (_Size=0xc) returned 0x29e2838 [0088.267] SysStringLen (param_1="NONE") returned 0x4 [0088.267] SysStringLen (param_1="DEFAULT") returned 0x7 [0088.267] SysStringLen (param_1="DEFAULT") returned 0x7 [0088.267] SysStringLen (param_1="NONE") returned 0x4 [0088.267] malloc (_Size=0x18) returned 0x29e2850 [0088.267] malloc (_Size=0xc) returned 0x29e2870 [0088.267] SysStringLen (param_1="CONNECT") returned 0x7 [0088.267] SysStringLen (param_1="DEFAULT") returned 0x7 [0088.267] malloc (_Size=0x18) returned 0x29e2888 [0088.267] malloc (_Size=0xc) returned 0x29e28a8 [0088.267] SysStringLen (param_1="CALL") returned 0x4 [0088.267] SysStringLen (param_1="DEFAULT") returned 0x7 [0088.267] SysStringLen (param_1="CALL") returned 0x4 [0088.267] SysStringLen (param_1="CONNECT") returned 0x7 [0088.267] malloc (_Size=0x18) returned 0x29e28c0 [0088.267] malloc (_Size=0xc) returned 0x29e04a0 [0088.268] SysStringLen (param_1="PKT") returned 0x3 [0088.268] SysStringLen (param_1="DEFAULT") returned 0x7 [0088.268] SysStringLen (param_1="PKT") returned 0x3 [0088.269] SysStringLen (param_1="NONE") returned 0x4 [0088.269] SysStringLen (param_1="NONE") returned 0x4 [0088.269] SysStringLen (param_1="PKT") returned 0x3 [0088.269] malloc (_Size=0x18) returned 0x29e04b8 [0088.269] malloc (_Size=0xc) returned 0x29e04d8 [0088.269] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0088.269] SysStringLen (param_1="DEFAULT") returned 0x7 [0088.269] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0088.269] SysStringLen (param_1="NONE") returned 0x4 [0088.269] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0088.269] SysStringLen (param_1="PKT") returned 0x3 [0088.269] SysStringLen (param_1="PKT") returned 0x3 [0088.269] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0088.269] malloc (_Size=0x18) returned 0x29e29e8 [0088.270] malloc (_Size=0xc) returned 0x29e2ce8 [0088.270] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0088.271] SysStringLen (param_1="DEFAULT") returned 0x7 [0088.271] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0088.271] SysStringLen (param_1="PKT") returned 0x3 [0088.271] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0088.271] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0088.271] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0088.271] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0088.280] malloc (_Size=0x18) returned 0x29e2a48 [0088.280] malloc (_Size=0x40) returned 0x29e2d00 [0088.280] malloc (_Size=0x20a) returned 0x29e9568 [0088.280] GetSystemDirectoryW (in: lpBuffer=0x29e9568, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0088.280] free (_Block=0x29e9568) [0088.280] malloc (_Size=0xc) returned 0x29e04f0 [0088.280] malloc (_Size=0xc) returned 0x29e0508 [0088.280] malloc (_Size=0xc) returned 0x29e96e0 [0088.280] SysStringLen (param_1="C:\\WINDOWS\\system32") returned 0x13 [0088.280] SysStringLen (param_1="\\wbem\\") returned 0x6 [0088.280] free (_Block=0x29e04f0) [0088.280] free (_Block=0x29e0508) [0088.280] SysStringByteLen (bstr="C:\\WINDOWS\\system32\\wbem\\") returned 0x32 [0088.280] free (_Block=0x29e96e0) [0088.280] malloc (_Size=0xc) returned 0x29e95f0 [0088.280] malloc (_Size=0xc) returned 0x29e9710 [0088.280] malloc (_Size=0xc) returned 0x29e96b0 [0088.280] SysStringLen (param_1="C:\\WINDOWS\\system32\\wbem\\") returned 0x19 [0088.280] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0088.280] free (_Block=0x29e95f0) [0088.280] free (_Block=0x29e9710) [0088.280] GetCurrentThreadId () returned 0x1284 [0088.281] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x267f7f4 | out: phkResult=0x267f7f4*=0x1a4) returned 0x0 [0088.281] RegQueryValueExW (in: hKey=0x1a4, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x267f800, lpcbData=0x267f7fc*=0x400 | out: lpType=0x0, lpData=0x267f800*=0x30, lpcbData=0x267f7fc*=0x4) returned 0x0 [0088.281] _wcsicmp (_String1="0", _String2="1") returned -1 [0088.281] _wcsicmp (_String1="0", _String2="2") returned -2 [0088.281] RegQueryValueExW (in: hKey=0x1a4, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x267f7fc*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x267f7fc*=0x42) returned 0x0 [0088.281] malloc (_Size=0x86) returned 0x29e04f0 [0088.281] RegQueryValueExW (in: hKey=0x1a4, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x29e04f0, lpcbData=0x267f7fc*=0x42 | out: lpType=0x0, lpData=0x29e04f0*=0x25, lpcbData=0x267f7fc*=0x42) returned 0x0 [0088.281] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0088.281] malloc (_Size=0x42) returned 0x29e9770 [0088.281] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0088.281] RegQueryValueExW (in: hKey=0x1a4, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x267f800, lpcbData=0x267f7fc*=0x400 | out: lpType=0x0, lpData=0x267f800*=0x36, lpcbData=0x267f7fc*=0xc) returned 0x0 [0088.281] _wtol (_String="65536") returned 65536 [0088.281] free (_Block=0x29e04f0) [0088.281] RegCloseKey (hKey=0x0) returned 0x6 [0088.281] CoCreateInstance (in: rclsid=0x136ad4*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x136ae4*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x267fc90 | out: ppv=0x267fc90*=0x29145a8) returned 0x0 [0088.486] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x29145a8, xmlSource=0x267fc14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\WINDOWS\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x267fc7c | out: isSuccessful=0x267fc7c*=0xffff) returned 0x0 [0089.834] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x29145a8, DOMElement=0x267fc8c | out: DOMElement=0x267fc8c*=0x2916b48) returned 0x0 [0089.834] malloc (_Size=0xc) returned 0x29e9668 [0089.835] IXMLDOMElement:getElementsByTagName (in: This=0x2916b48, tagName="XSLFORMAT", resultList=0x267fc88 | out: resultList=0x267fc88*=0x2919ca0) returned 0x0 [0089.835] free (_Block=0x29e9668) [0089.835] IXMLDOMNodeList:get_length (in: This=0x2919ca0, listLength=0x267fc84 | out: listLength=0x267fc84*=21) returned 0x0 [0089.835] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=0, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.836] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="texttable.xsl") returned 0x0 [0089.836] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.836] malloc (_Size=0xc) returned 0x29e9728 [0089.836] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.836] free (_Block=0x29e9728) [0089.836] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TABLE", varVal2=0x0)) returned 0x0 [0089.837] malloc (_Size=0xc) returned 0x29e95f0 [0089.837] malloc (_Size=0xc) returned 0x29e9728 [0089.837] malloc (_Size=0x18) returned 0x29e2988 [0089.837] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.837] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.837] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.837] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=1, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.837] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="textvaluelist.xsl") returned 0x0 [0089.837] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.837] malloc (_Size=0xc) returned 0x29e9758 [0089.837] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.837] free (_Block=0x29e9758) [0089.837] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VALUE", varVal2=0x0)) returned 0x0 [0089.837] malloc (_Size=0xc) returned 0x29e95a8 [0089.837] malloc (_Size=0xc) returned 0x29e96e0 [0089.837] SysStringLen (param_1="VALUE") returned 0x5 [0089.837] SysStringLen (param_1="TABLE") returned 0x5 [0089.837] SysStringLen (param_1="TABLE") returned 0x5 [0089.837] SysStringLen (param_1="VALUE") returned 0x5 [0089.837] malloc (_Size=0x18) returned 0x29e2a68 [0089.837] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.837] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.838] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.838] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=2, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.838] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="textvaluelist.xsl") returned 0x0 [0089.838] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.838] malloc (_Size=0xc) returned 0x29e9620 [0089.838] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.838] free (_Block=0x29e9620) [0089.838] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LIST", varVal2=0x0)) returned 0x0 [0089.838] malloc (_Size=0xc) returned 0x29e9710 [0089.838] malloc (_Size=0xc) returned 0x29e9608 [0089.838] SysStringLen (param_1="LIST") returned 0x4 [0089.838] SysStringLen (param_1="TABLE") returned 0x5 [0089.838] malloc (_Size=0x18) returned 0x29e29a8 [0089.838] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.838] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.838] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.838] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=3, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.838] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="rawxml.xsl") returned 0x0 [0089.838] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.838] malloc (_Size=0xc) returned 0x29e96c8 [0089.838] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.838] free (_Block=0x29e96c8) [0089.839] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RAWXML", varVal2=0x0)) returned 0x0 [0089.839] malloc (_Size=0xc) returned 0x29e95d8 [0089.839] malloc (_Size=0xc) returned 0x29e9740 [0089.839] SysStringLen (param_1="RAWXML") returned 0x6 [0089.839] SysStringLen (param_1="TABLE") returned 0x5 [0089.839] SysStringLen (param_1="RAWXML") returned 0x6 [0089.839] SysStringLen (param_1="LIST") returned 0x4 [0089.839] SysStringLen (param_1="LIST") returned 0x4 [0089.839] SysStringLen (param_1="RAWXML") returned 0x6 [0089.839] malloc (_Size=0x18) returned 0x29e2c08 [0089.839] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.839] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.839] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.839] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=4, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.839] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="htable.xsl") returned 0x0 [0089.839] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.839] malloc (_Size=0xc) returned 0x29e9620 [0089.839] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.839] free (_Block=0x29e9620) [0089.839] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HTABLE", varVal2=0x0)) returned 0x0 [0089.839] malloc (_Size=0xc) returned 0x29e9758 [0089.839] malloc (_Size=0xc) returned 0x29e9620 [0089.839] SysStringLen (param_1="HTABLE") returned 0x6 [0089.839] SysStringLen (param_1="TABLE") returned 0x5 [0089.839] SysStringLen (param_1="HTABLE") returned 0x6 [0089.839] SysStringLen (param_1="LIST") returned 0x4 [0089.839] malloc (_Size=0x18) returned 0x29e2a28 [0089.839] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.839] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.839] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.839] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=5, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.840] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="hform.xsl") returned 0x0 [0089.840] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.840] malloc (_Size=0xc) returned 0x29e9590 [0089.840] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.840] free (_Block=0x29e9590) [0089.840] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HFORM", varVal2=0x0)) returned 0x0 [0089.840] malloc (_Size=0xc) returned 0x29e9638 [0089.840] malloc (_Size=0xc) returned 0x29e9590 [0089.840] SysStringLen (param_1="HFORM") returned 0x5 [0089.840] SysStringLen (param_1="TABLE") returned 0x5 [0089.840] SysStringLen (param_1="HFORM") returned 0x5 [0089.840] SysStringLen (param_1="LIST") returned 0x4 [0089.840] SysStringLen (param_1="HFORM") returned 0x5 [0089.840] SysStringLen (param_1="HTABLE") returned 0x6 [0089.840] malloc (_Size=0x18) returned 0x29e29c8 [0089.840] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.840] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.840] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.840] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=6, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.840] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="xml.xsl") returned 0x0 [0089.840] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.840] malloc (_Size=0xc) returned 0x29e9668 [0089.840] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.840] free (_Block=0x29e9668) [0089.841] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XML", varVal2=0x0)) returned 0x0 [0089.841] malloc (_Size=0xc) returned 0x29e9650 [0089.841] malloc (_Size=0xc) returned 0x29e9668 [0089.841] SysStringLen (param_1="XML") returned 0x3 [0089.841] SysStringLen (param_1="TABLE") returned 0x5 [0089.841] SysStringLen (param_1="XML") returned 0x3 [0089.841] SysStringLen (param_1="VALUE") returned 0x5 [0089.841] SysStringLen (param_1="VALUE") returned 0x5 [0089.841] SysStringLen (param_1="XML") returned 0x3 [0089.841] malloc (_Size=0x18) returned 0x29e2b28 [0089.841] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.841] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.841] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.841] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=7, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.841] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="mof.xsl") returned 0x0 [0089.841] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.841] malloc (_Size=0xc) returned 0x29e9680 [0089.841] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.841] free (_Block=0x29e9680) [0089.841] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MOF", varVal2=0x0)) returned 0x0 [0089.841] malloc (_Size=0xc) returned 0x29e9680 [0089.841] malloc (_Size=0xc) returned 0x29e96f8 [0089.841] SysStringLen (param_1="MOF") returned 0x3 [0089.841] SysStringLen (param_1="TABLE") returned 0x5 [0089.841] SysStringLen (param_1="MOF") returned 0x3 [0089.841] SysStringLen (param_1="LIST") returned 0x4 [0089.841] SysStringLen (param_1="MOF") returned 0x3 [0089.841] SysStringLen (param_1="RAWXML") returned 0x6 [0089.841] SysStringLen (param_1="LIST") returned 0x4 [0089.841] SysStringLen (param_1="MOF") returned 0x3 [0089.841] malloc (_Size=0x18) returned 0x29e2aa8 [0089.841] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.842] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.842] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.842] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=8, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.842] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="csv.xsl") returned 0x0 [0089.842] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.842] malloc (_Size=0xc) returned 0x29e9698 [0089.842] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.842] free (_Block=0x29e9698) [0089.842] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CSV", varVal2=0x0)) returned 0x0 [0089.842] malloc (_Size=0xc) returned 0x29e9698 [0089.842] malloc (_Size=0xc) returned 0x29e95c0 [0089.842] SysStringLen (param_1="CSV") returned 0x3 [0089.842] SysStringLen (param_1="TABLE") returned 0x5 [0089.842] SysStringLen (param_1="CSV") returned 0x3 [0089.842] SysStringLen (param_1="LIST") returned 0x4 [0089.842] SysStringLen (param_1="CSV") returned 0x3 [0089.842] SysStringLen (param_1="HTABLE") returned 0x6 [0089.842] SysStringLen (param_1="CSV") returned 0x3 [0089.842] SysStringLen (param_1="HFORM") returned 0x5 [0089.842] malloc (_Size=0x18) returned 0x29e2bc8 [0089.842] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.842] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.842] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.842] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=9, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.842] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="texttable.xsl") returned 0x0 [0089.842] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.842] malloc (_Size=0xc) returned 0x29e96c8 [0089.843] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.843] free (_Block=0x29e96c8) [0089.843] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys.xsl", varVal2=0x0)) returned 0x0 [0089.843] malloc (_Size=0xc) returned 0x29e96c8 [0089.843] malloc (_Size=0xc) returned 0x29eaa90 [0089.843] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.843] SysStringLen (param_1="TABLE") returned 0x5 [0089.843] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.843] SysStringLen (param_1="VALUE") returned 0x5 [0089.843] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.843] SysStringLen (param_1="XML") returned 0x3 [0089.843] SysStringLen (param_1="XML") returned 0x3 [0089.843] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.843] malloc (_Size=0x18) returned 0x29e2b48 [0089.843] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.843] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.843] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.843] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=10, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.843] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="texttable.xsl") returned 0x0 [0089.843] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.843] malloc (_Size=0xc) returned 0x29eab98 [0089.843] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.843] free (_Block=0x29eab98) [0089.843] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys", varVal2=0x0)) returned 0x0 [0089.843] malloc (_Size=0xc) returned 0x29eaa00 [0089.843] malloc (_Size=0xc) returned 0x29eaaf0 [0089.843] SysStringLen (param_1="texttablewsys") returned 0xd [0089.843] SysStringLen (param_1="TABLE") returned 0x5 [0089.843] SysStringLen (param_1="texttablewsys") returned 0xd [0089.843] SysStringLen (param_1="XML") returned 0x3 [0089.843] SysStringLen (param_1="texttablewsys") returned 0xd [0089.844] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.844] SysStringLen (param_1="XML") returned 0x3 [0089.844] SysStringLen (param_1="texttablewsys") returned 0xd [0089.844] malloc (_Size=0x18) returned 0x29e2968 [0089.844] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.844] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.844] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.844] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=11, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.844] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="texttable.xsl") returned 0x0 [0089.844] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.844] malloc (_Size=0xc) returned 0x29eab08 [0089.844] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.844] free (_Block=0x29eab08) [0089.844] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat.xsl", varVal2=0x0)) returned 0x0 [0089.844] malloc (_Size=0xc) returned 0x29eac10 [0089.844] malloc (_Size=0xc) returned 0x29eaa60 [0089.844] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.844] SysStringLen (param_1="TABLE") returned 0x5 [0089.844] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.844] SysStringLen (param_1="XML") returned 0x3 [0089.844] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.844] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.844] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.844] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.844] malloc (_Size=0x18) returned 0x29e2b68 [0089.844] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.844] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.844] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.844] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=12, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.844] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="texttable.xsl") returned 0x0 [0089.845] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.845] malloc (_Size=0xc) returned 0x29eac28 [0089.845] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.845] free (_Block=0x29eac28) [0089.845] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat", varVal2=0x0)) returned 0x0 [0089.845] malloc (_Size=0xc) returned 0x29eaa18 [0089.845] malloc (_Size=0xc) returned 0x29eab98 [0089.845] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.845] SysStringLen (param_1="TABLE") returned 0x5 [0089.845] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.845] SysStringLen (param_1="XML") returned 0x3 [0089.845] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.845] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.845] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.845] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.845] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.845] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.845] malloc (_Size=0x18) returned 0x29e2b88 [0089.845] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.845] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.845] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.845] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=13, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.845] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="texttable.xsl") returned 0x0 [0089.845] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.845] malloc (_Size=0xc) returned 0x29eac28 [0089.845] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.845] free (_Block=0x29eac28) [0089.846] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys.xsl", varVal2=0x0)) returned 0x0 [0089.846] malloc (_Size=0xc) returned 0x29ea9a0 [0089.846] malloc (_Size=0xc) returned 0x29eaa30 [0089.846] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.846] SysStringLen (param_1="TABLE") returned 0x5 [0089.846] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.846] SysStringLen (param_1="XML") returned 0x3 [0089.846] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.846] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.846] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.846] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.846] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.846] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.846] malloc (_Size=0x18) returned 0x29e2a88 [0089.846] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.846] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.846] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.846] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=14, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.846] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="texttable.xsl") returned 0x0 [0089.846] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.846] malloc (_Size=0xc) returned 0x29ea9b8 [0089.846] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.846] free (_Block=0x29ea9b8) [0089.846] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys", varVal2=0x0)) returned 0x0 [0089.846] malloc (_Size=0xc) returned 0x29eaaa8 [0089.846] malloc (_Size=0xc) returned 0x29ea9e8 [0089.846] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0089.846] SysStringLen (param_1="TABLE") returned 0x5 [0089.846] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0089.846] SysStringLen (param_1="XML") returned 0x3 [0089.846] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0089.846] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.846] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0089.846] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.846] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0089.846] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.847] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.847] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0089.847] malloc (_Size=0x18) returned 0x29e2c88 [0089.847] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.847] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.847] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.847] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=15, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.847] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="htable.xsl") returned 0x0 [0089.847] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.847] malloc (_Size=0xc) returned 0x29eaa78 [0089.847] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.847] free (_Block=0x29eaa78) [0089.847] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby.xsl", varVal2=0x0)) returned 0x0 [0089.847] malloc (_Size=0xc) returned 0x29eabb0 [0089.847] malloc (_Size=0xc) returned 0x29eab20 [0089.847] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0089.847] SysStringLen (param_1="TABLE") returned 0x5 [0089.847] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0089.847] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.847] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0089.847] SysStringLen (param_1="XML") returned 0x3 [0089.847] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0089.847] SysStringLen (param_1="texttablewsys") returned 0xd [0089.847] SysStringLen (param_1="XML") returned 0x3 [0089.847] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0089.847] malloc (_Size=0x18) returned 0x29e2ac8 [0089.847] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.847] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.847] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.847] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=16, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.848] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="htable.xsl") returned 0x0 [0089.848] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.848] malloc (_Size=0xc) returned 0x29eabc8 [0089.848] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.848] free (_Block=0x29eabc8) [0089.848] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby", varVal2=0x0)) returned 0x0 [0089.848] malloc (_Size=0xc) returned 0x29eab38 [0089.848] malloc (_Size=0xc) returned 0x29eac28 [0089.848] SysStringLen (param_1="htable-sortby") returned 0xd [0089.848] SysStringLen (param_1="TABLE") returned 0x5 [0089.848] SysStringLen (param_1="htable-sortby") returned 0xd [0089.848] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.848] SysStringLen (param_1="htable-sortby") returned 0xd [0089.848] SysStringLen (param_1="XML") returned 0x3 [0089.848] SysStringLen (param_1="htable-sortby") returned 0xd [0089.848] SysStringLen (param_1="texttablewsys") returned 0xd [0089.848] SysStringLen (param_1="htable-sortby") returned 0xd [0089.848] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0089.848] SysStringLen (param_1="XML") returned 0x3 [0089.848] SysStringLen (param_1="htable-sortby") returned 0xd [0089.848] malloc (_Size=0x18) returned 0x29e2c48 [0089.848] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.848] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.848] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.848] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=17, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.848] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="mof.xsl") returned 0x0 [0089.848] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.848] malloc (_Size=0xc) returned 0x29eaa48 [0089.849] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.849] free (_Block=0x29eaa48) [0089.849] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat.xsl", varVal2=0x0)) returned 0x0 [0089.849] malloc (_Size=0xc) returned 0x29ea970 [0089.849] malloc (_Size=0xc) returned 0x29eabe0 [0089.849] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0089.849] SysStringLen (param_1="TABLE") returned 0x5 [0089.849] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0089.849] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.849] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0089.849] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.849] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0089.849] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.849] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.849] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0089.849] malloc (_Size=0x18) returned 0x29e2cc8 [0089.849] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.849] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.849] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.849] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=18, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.849] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="mof.xsl") returned 0x0 [0089.849] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.849] malloc (_Size=0xc) returned 0x29eab08 [0089.849] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.849] free (_Block=0x29eab08) [0089.849] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat", varVal2=0x0)) returned 0x0 [0089.849] malloc (_Size=0xc) returned 0x29eab08 [0089.849] malloc (_Size=0xc) returned 0x29eaac0 [0089.850] SysStringLen (param_1="wmiclimofformat") returned 0xf [0089.850] SysStringLen (param_1="TABLE") returned 0x5 [0089.850] SysStringLen (param_1="wmiclimofformat") returned 0xf [0089.850] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.850] SysStringLen (param_1="wmiclimofformat") returned 0xf [0089.850] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.850] SysStringLen (param_1="wmiclimofformat") returned 0xf [0089.850] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0089.850] SysStringLen (param_1="wmiclimofformat") returned 0xf [0089.850] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0089.850] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.850] SysStringLen (param_1="wmiclimofformat") returned 0xf [0089.850] malloc (_Size=0x18) returned 0x29e2a08 [0089.850] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.850] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.850] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.850] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=19, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.850] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="textvaluelist.xsl") returned 0x0 [0089.850] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.850] malloc (_Size=0xc) returned 0x29eaa48 [0089.850] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.850] free (_Block=0x29eaa48) [0089.850] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat.xsl", varVal2=0x0)) returned 0x0 [0089.850] malloc (_Size=0xc) returned 0x29eab50 [0089.850] malloc (_Size=0xc) returned 0x29eab68 [0089.850] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0089.850] SysStringLen (param_1="TABLE") returned 0x5 [0089.850] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0089.850] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.850] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0089.850] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.850] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0089.850] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.850] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.850] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0089.851] malloc (_Size=0x18) returned 0x29e2ae8 [0089.851] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.851] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.851] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.851] IXMLDOMNodeList:get_item (in: This=0x2919ca0, index=20, listItem=0x267fca4 | out: listItem=0x267fca4*=0x2916b88) returned 0x0 [0089.851] IXMLDOMNode:get_text (in: This=0x2916b88, text=0x267fca8 | out: text=0x267fca8*="textvaluelist.xsl") returned 0x0 [0089.851] IXMLDOMNode:get_attributes (in: This=0x2916b88, attributeMap=0x267fca0 | out: attributeMap=0x267fca0*=0x2919fa8) returned 0x0 [0089.851] malloc (_Size=0xc) returned 0x29eabc8 [0089.851] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2919fa8, name="KEYWORD", namedItem=0x267fc9c | out: namedItem=0x267fc9c*=0x2919ff8) returned 0x0 [0089.851] free (_Block=0x29eabc8) [0089.851] IXMLDOMNode:get_nodeValue (in: This=0x2919ff8, value=0x267fc5c | out: value=0x267fc5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat", varVal2=0x0)) returned 0x0 [0089.851] malloc (_Size=0xc) returned 0x29ea988 [0089.851] malloc (_Size=0xc) returned 0x29eab80 [0089.851] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0089.851] SysStringLen (param_1="TABLE") returned 0x5 [0089.851] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0089.851] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0089.851] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0089.851] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0089.851] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0089.851] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.851] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0089.851] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0089.851] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0089.851] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0089.851] malloc (_Size=0x18) returned 0x29e2ba8 [0089.851] IUnknown:Release (This=0x2916b88) returned 0x0 [0089.851] IUnknown:Release (This=0x2919fa8) returned 0x0 [0089.851] IUnknown:Release (This=0x2919ff8) returned 0x0 [0089.851] IUnknown:Release (This=0x2919ca0) returned 0x0 [0089.852] FreeThreadedDOMDocument:IUnknown:Release (This=0x2916b48) returned 0x1 [0089.852] FreeThreadedDOMDocument:IUnknown:Release (This=0x29145a8) returned 0x0 [0089.852] free (_Block=0x29e96b0) [0089.852] GetCommandLineW () returned="C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete" [0089.852] malloc (_Size=0x70) returned 0x29ead30 [0089.852] memcpy_s (in: _Destination=0x29ead30, _DestinationSize=0x6e, _Source=0x29f1af8, _SourceSize=0x68 | out: _Destination=0x29ead30) returned 0x0 [0089.852] malloc (_Size=0xc) returned 0x29eac40 [0089.852] malloc (_Size=0xc) returned 0x29eabc8 [0089.852] malloc (_Size=0xc) returned 0x29ea958 [0089.852] malloc (_Size=0xc) returned 0x29ea9b8 [0089.852] malloc (_Size=0x80) returned 0x29eada8 [0089.852] GetLocalTime (in: lpSystemTime=0x267fc40 | out: lpSystemTime=0x267fc40*(wYear=0x7e4, wMonth=0xa, wDayOfWeek=0x0, wDay=0xb, wHour=0x0, wMinute=0x2a, wSecond=0x1, wMilliseconds=0x127)) [0089.852] _vsnwprintf (in: _Buffer=0x29eada8, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x267fc20 | out: _Buffer="10-11-2020T00:42:01") returned 19 [0089.852] lstrlenW (lpString=" shadowcopy delete") returned 19 [0089.852] malloc (_Size=0x28) returned 0x29e0578 [0089.852] lstrlenW (lpString=" shadowcopy delete") returned 19 [0089.852] lstrlenW (lpString=" shadowcopy delete") returned 19 [0089.852] malloc (_Size=0x28) returned 0x29eae30 [0089.852] lstrlenW (lpString=" shadowcopy delete") returned 19 [0089.852] lstrlenW (lpString=" shadowcopy delete") returned 19 [0089.852] lstrlenW (lpString=" shadowcopy delete") returned 19 [0089.852] malloc (_Size=0x16) returned 0x29e2ca8 [0089.852] lstrlenW (lpString="shadowcopy") returned 10 [0089.852] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0089.852] malloc (_Size=0x16) returned 0x29e2b08 [0089.852] malloc (_Size=0x4) returned 0x29eae60 [0089.852] free (_Block=0x0) [0089.852] free (_Block=0x29e2ca8) [0089.852] lstrlenW (lpString=" shadowcopy delete") returned 19 [0089.852] malloc (_Size=0xe) returned 0x29eaa48 [0089.852] lstrlenW (lpString="delete") returned 6 [0089.852] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0089.852] malloc (_Size=0xe) returned 0x29ea9d0 [0089.852] malloc (_Size=0x8) returned 0x29eae70 [0089.852] memmove_s (in: _Destination=0x29eae70, _DestinationSize=0x4, _Source=0x29eae60, _SourceSize=0x4 | out: _Destination=0x29eae70) returned 0x0 [0089.852] free (_Block=0x29eae60) [0089.852] free (_Block=0x0) [0089.852] free (_Block=0x29eaa48) [0089.852] malloc (_Size=0x8) returned 0x29eae60 [0089.853] lstrlenW (lpString="QUIT") returned 4 [0089.853] lstrlenW (lpString="shadowcopy") returned 10 [0089.853] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0089.853] lstrlenW (lpString="EXIT") returned 4 [0089.853] lstrlenW (lpString="shadowcopy") returned 10 [0089.853] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0089.853] free (_Block=0x29eae60) [0089.853] WbemLocator:IUnknown:AddRef (This=0x2a03708) returned 0x2 [0089.853] malloc (_Size=0x8) returned 0x29eae60 [0089.853] lstrlenW (lpString="/") returned 1 [0089.853] lstrlenW (lpString="shadowcopy") returned 10 [0089.853] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0089.853] lstrlenW (lpString="-") returned 1 [0089.853] lstrlenW (lpString="shadowcopy") returned 10 [0089.853] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0089.853] lstrlenW (lpString="CLASS") returned 5 [0089.853] lstrlenW (lpString="shadowcopy") returned 10 [0089.853] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0089.853] lstrlenW (lpString="PATH") returned 4 [0089.853] lstrlenW (lpString="shadowcopy") returned 10 [0089.853] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0089.853] lstrlenW (lpString="CONTEXT") returned 7 [0089.853] lstrlenW (lpString="shadowcopy") returned 10 [0089.853] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0089.853] lstrlenW (lpString="shadowcopy") returned 10 [0089.853] malloc (_Size=0x16) returned 0x29e2be8 [0089.853] lstrlenW (lpString="shadowcopy") returned 10 [0089.853] GetCurrentThreadId () returned 0x1284 [0089.853] ??0CHString@@QAE@XZ () returned 0x267fb98 [0089.853] malloc (_Size=0xc) returned 0x29eaa48 [0089.853] malloc (_Size=0xc) returned 0x29eabf8 [0089.853] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2a03708, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x178540 | out: ppNamespace=0x178540*=0x2a0abe0) returned 0x0 [0091.239] free (_Block=0x29eabf8) [0091.239] free (_Block=0x29eaa48) [0091.239] CoSetProxyBlanket (pProxy=0x2a0abe0, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0091.239] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0091.239] GetCurrentThreadId () returned 0x1284 [0091.239] ??0CHString@@QAE@XZ () returned 0x267fb3c [0091.239] malloc (_Size=0xc) returned 0x29eaa78 [0091.239] malloc (_Size=0xc) returned 0x29eaa48 [0091.239] malloc (_Size=0xc) returned 0x29eaad8 [0091.240] malloc (_Size=0xc) returned 0x29eabf8 [0091.240] SysStringLen (param_1="root\\cli") returned 0x8 [0091.240] SysStringLen (param_1="\\") returned 0x1 [0091.240] malloc (_Size=0xc) returned 0x29eac58 [0091.240] SysStringLen (param_1="root\\cli\\") returned 0x9 [0091.240] SysStringLen (param_1="ms_409") returned 0x6 [0091.240] free (_Block=0x29eabf8) [0091.240] free (_Block=0x29eaad8) [0091.240] free (_Block=0x29eaa48) [0091.240] free (_Block=0x29eaa78) [0091.240] malloc (_Size=0xc) returned 0x29eaad8 [0091.240] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2a03708, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x178544 | out: ppNamespace=0x178544*=0x2a38c08) returned 0x0 [0091.287] free (_Block=0x29eaad8) [0091.287] free (_Block=0x29eac58) [0091.287] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0091.287] GetCurrentThreadId () returned 0x1284 [0091.287] ??0CHString@@QAE@XZ () returned 0x267fb98 [0091.287] malloc (_Size=0xc) returned 0x29ead00 [0091.287] malloc (_Size=0xc) returned 0x29eacb8 [0091.287] malloc (_Size=0xc) returned 0x29ead18 [0091.287] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0091.287] malloc (_Size=0x3a) returned 0x29eb5f0 [0091.287] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1314a8, cbMultiByte=-1, lpWideCharStr=0x29eb5f0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0091.287] free (_Block=0x29eb5f0) [0091.287] malloc (_Size=0xc) returned 0x29eacd0 [0091.287] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0091.287] SysStringLen (param_1="shadowcopy") returned 0xa [0091.287] malloc (_Size=0xc) returned 0x29eac58 [0091.287] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0091.287] SysStringLen (param_1="'") returned 0x1 [0091.287] free (_Block=0x29eacd0) [0091.287] free (_Block=0x29ead18) [0091.287] free (_Block=0x29eacb8) [0091.287] free (_Block=0x29ead00) [0091.287] IWbemServices:GetObject (in: This=0x2a0abe0, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x267fb94*=0x0, ppCallResult=0x0 | out: ppObject=0x267fb94*=0x2a46268, ppCallResult=0x0) returned 0x0 [0091.299] malloc (_Size=0xc) returned 0x29ead18 [0091.299] IWbemClassObject:Get (in: This=0x2a46268, wszName="Target", lFlags=0, pVal=0x267fb6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x267fb6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0091.299] free (_Block=0x29ead18) [0091.299] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0091.299] malloc (_Size=0x3e) returned 0x29eb5f0 [0091.299] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0091.300] malloc (_Size=0xc) returned 0x29ead00 [0091.300] IWbemClassObject:Get (in: This=0x2a46268, wszName="PWhere", lFlags=0, pVal=0x267fb6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x267fb6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0091.300] free (_Block=0x29ead00) [0091.300] lstrlenW (lpString=" Where ID = '#'") returned 15 [0091.300] malloc (_Size=0x20) returned 0x29eb638 [0091.300] lstrlenW (lpString=" Where ID = '#'") returned 15 [0091.300] malloc (_Size=0xc) returned 0x29eace8 [0091.300] IWbemClassObject:Get (in: This=0x2a46268, wszName="Connection", lFlags=0, pVal=0x267fb6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x267fb6c*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a46400, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0091.300] free (_Block=0x29eace8) [0091.300] IUnknown:QueryInterface (in: This=0x2a46400, riid=0x136a04*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x267fb88 | out: ppvObject=0x267fb88*=0x2a46400) returned 0x0 [0091.300] GetCurrentThreadId () returned 0x1284 [0091.300] ??0CHString@@QAE@XZ () returned 0x267fb04 [0091.300] malloc (_Size=0xc) returned 0x29eac88 [0091.300] IWbemClassObject:Get (in: This=0x2a46400, wszName="Namespace", lFlags=0, pVal=0x267faec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x267faec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0091.300] free (_Block=0x29eac88) [0091.300] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0091.300] malloc (_Size=0x16) returned 0x29e2ca8 [0091.300] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0091.300] malloc (_Size=0xc) returned 0x29eac70 [0091.300] IWbemClassObject:Get (in: This=0x2a46400, wszName="Locale", lFlags=0, pVal=0x267faec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a2fdc4, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x267faec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0091.300] free (_Block=0x29eac70) [0091.300] lstrlenW (lpString="ms_409") returned 6 [0091.300] malloc (_Size=0xe) returned 0x29eacb8 [0091.300] lstrlenW (lpString="ms_409") returned 6 [0091.300] malloc (_Size=0xc) returned 0x29eacd0 [0091.300] IWbemClassObject:Get (in: This=0x2a46400, wszName="User", lFlags=0, pVal=0x267faec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a2fdc4, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x267faec*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0091.300] free (_Block=0x29eacd0) [0091.300] malloc (_Size=0xc) returned 0x29eacd0 [0091.301] IWbemClassObject:Get (in: This=0x2a46400, wszName="Password", lFlags=0, pVal=0x267faec*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x267faec*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0091.301] free (_Block=0x29eacd0) [0091.301] malloc (_Size=0xc) returned 0x29eace8 [0091.301] IWbemClassObject:Get (in: This=0x2a46400, wszName="Server", lFlags=0, pVal=0x267faec*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x267faec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0091.301] free (_Block=0x29eace8) [0091.301] lstrlenW (lpString=".") returned 1 [0091.301] malloc (_Size=0x4) returned 0x29eb660 [0091.301] lstrlenW (lpString=".") returned 1 [0091.301] malloc (_Size=0xc) returned 0x29eaca0 [0091.301] IWbemClassObject:Get (in: This=0x2a46400, wszName="Authority", lFlags=0, pVal=0x267faec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a2fdc4, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x267faec*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0091.301] free (_Block=0x29eaca0) [0091.301] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0091.301] IUnknown:Release (This=0x2a46400) returned 0x1 [0091.301] GetCurrentThreadId () returned 0x1284 [0091.301] ??0CHString@@QAE@XZ () returned 0x267faf8 [0091.301] malloc (_Size=0xc) returned 0x29eaca0 [0091.301] IWbemClassObject:Get (in: This=0x2a46268, wszName="__RELPATH", lFlags=0, pVal=0x267fae0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x267fae0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0091.301] free (_Block=0x29eaca0) [0091.301] malloc (_Size=0xc) returned 0x29eac70 [0091.301] GetCurrentThreadId () returned 0x1284 [0091.301] ??0CHString@@QAE@XZ () returned 0x267fa74 [0091.301] ??0CHString@@QAE@PBG@Z () returned 0x267fa68 [0091.301] ??0CHString@@QAE@ABV0@@Z () returned 0x267f9f0 [0091.301] ?Empty@CHString@@QAEXXZ () returned 0x6f2565f8 [0091.301] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x29eb670 [0091.301] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0091.301] ?Left@CHString@@QBE?AV1@H@Z () returned 0x267f9e8 [0091.301] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x267f9ec [0091.301] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x267fa68 [0091.301] ??1CHString@@QAE@XZ () returned 0x1 [0091.302] ??1CHString@@QAE@XZ () returned 0x1 [0091.302] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x267f9e4 [0091.302] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x267f9f0 [0091.302] ??1CHString@@QAE@XZ () returned 0x1 [0091.302] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x29eb6d8 [0091.302] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0091.302] ?Left@CHString@@QBE?AV1@H@Z () returned 0x267f9e8 [0091.302] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x267f9ec [0091.302] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x267fa68 [0091.302] ??1CHString@@QAE@XZ () returned 0x1 [0091.302] ??1CHString@@QAE@XZ () returned 0x1 [0091.302] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x267f9e4 [0091.302] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x267f9f0 [0091.302] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0091.302] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x6f2565ec [0091.302] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0091.302] malloc (_Size=0xc) returned 0x29eac88 [0091.302] malloc (_Size=0xc) returned 0x29eacd0 [0091.302] malloc (_Size=0xc) returned 0x29ead18 [0091.302] malloc (_Size=0xc) returned 0x29eace8 [0091.302] malloc (_Size=0xc) returned 0x29eaca0 [0091.302] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0091.302] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0091.302] malloc (_Size=0xc) returned 0x29ead00 [0091.302] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0091.302] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0091.302] malloc (_Size=0xc) returned 0x29eabf8 [0091.302] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0091.302] SysStringLen (param_1="\"") returned 0x1 [0091.302] free (_Block=0x29ead00) [0091.302] free (_Block=0x29eaca0) [0091.302] free (_Block=0x29eace8) [0091.302] free (_Block=0x29ead18) [0091.302] free (_Block=0x29eacd0) [0091.302] free (_Block=0x29eac88) [0091.302] IWbemServices:GetObject (in: This=0x2a38c08, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x267fa84*=0x0, ppCallResult=0x0 | out: ppObject=0x267fa84*=0x2a46960, ppCallResult=0x0) returned 0x0 [0091.317] malloc (_Size=0xc) returned 0x29eac88 [0091.318] IWbemClassObject:Get (in: This=0x2a46960, wszName="Text", lFlags=0, pVal=0x267fa4c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x267fa4c*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a46f58*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x2a0ba08, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0091.318] free (_Block=0x29eac88) [0091.318] SafeArrayGetLBound (in: psa=0x2a46f58, nDim=0x1, plLbound=0x267fa60 | out: plLbound=0x267fa60) returned 0x0 [0091.318] SafeArrayGetUBound (in: psa=0x2a46f58, nDim=0x1, plUbound=0x267fa5c | out: plUbound=0x267fa5c) returned 0x0 [0091.318] SafeArrayGetElement (in: psa=0x2a46f58, rgIndices=0x267fa78, pv=0x267fa70 | out: pv=0x267fa70) returned 0x0 [0091.318] malloc (_Size=0xc) returned 0x29ead18 [0091.318] malloc (_Size=0xc) returned 0x29eacd0 [0091.318] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0091.318] free (_Block=0x29ead18) [0091.318] IUnknown:Release (This=0x2a46960) returned 0x0 [0091.318] free (_Block=0x29eabf8) [0091.318] ??1CHString@@QAE@XZ () returned 0x1 [0091.318] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0091.318] free (_Block=0x29eac70) [0091.318] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0091.318] lstrlenW (lpString="Shadow copy management.") returned 23 [0091.318] malloc (_Size=0x30) returned 0x29eb670 [0091.318] lstrlenW (lpString="Shadow copy management.") returned 23 [0091.318] free (_Block=0x29eacd0) [0091.318] IUnknown:Release (This=0x2a46268) returned 0x0 [0091.318] free (_Block=0x29eac58) [0091.318] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0091.318] lstrlenW (lpString="PATH") returned 4 [0091.318] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0091.319] lstrlenW (lpString="WHERE") returned 5 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0091.319] lstrlenW (lpString="(") returned 1 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0091.319] lstrlenW (lpString="/") returned 1 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0091.319] lstrlenW (lpString="-") returned 1 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0091.319] malloc (_Size=0xc) returned 0x29eacd0 [0091.319] lstrlenW (lpString="GET") returned 3 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0091.319] lstrlenW (lpString="LIST") returned 4 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0091.319] lstrlenW (lpString="SET") returned 3 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0091.319] lstrlenW (lpString="CREATE") returned 6 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0091.319] lstrlenW (lpString="CALL") returned 4 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0091.319] lstrlenW (lpString="ASSOC") returned 5 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0091.319] lstrlenW (lpString="DELETE") returned 6 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0091.319] free (_Block=0x29eacd0) [0091.319] lstrlenW (lpString="/") returned 1 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0091.319] lstrlenW (lpString="-") returned 1 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] malloc (_Size=0xe) returned 0x29eac88 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] lstrlenW (lpString="GET") returned 3 [0091.319] lstrlenW (lpString="delete") returned 6 [0091.319] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0091.319] lstrlenW (lpString="LIST") returned 4 [0091.320] lstrlenW (lpString="delete") returned 6 [0091.320] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0091.320] lstrlenW (lpString="SET") returned 3 [0091.320] lstrlenW (lpString="delete") returned 6 [0091.320] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0091.320] lstrlenW (lpString="CREATE") returned 6 [0091.320] lstrlenW (lpString="delete") returned 6 [0091.320] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0091.320] lstrlenW (lpString="CALL") returned 4 [0091.320] lstrlenW (lpString="delete") returned 6 [0091.320] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0091.320] lstrlenW (lpString="ASSOC") returned 5 [0091.320] lstrlenW (lpString="delete") returned 6 [0091.320] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0091.320] lstrlenW (lpString="DELETE") returned 6 [0091.320] lstrlenW (lpString="delete") returned 6 [0091.320] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0091.320] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0091.320] malloc (_Size=0x3e) returned 0x29eb6a8 [0091.320] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0091.320] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xb7ab9290 | out: _String="Select", _Context=0xb7ab9290) returned="Select" [0091.320] malloc (_Size=0xc) returned 0x29eaca0 [0091.320] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xb7ab9290 | out: _String=0x0, _Context=0xb7ab9290) returned="*" [0091.320] lstrlenW (lpString="FROM") returned 4 [0091.320] lstrlenW (lpString="*") returned 1 [0091.320] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0091.320] malloc (_Size=0xc) returned 0x29eacd0 [0091.320] free (_Block=0x29eaca0) [0091.320] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xb7ab9290 | out: _String=0x0, _Context=0xb7ab9290) returned="from" [0091.320] lstrlenW (lpString="FROM") returned 4 [0091.320] lstrlenW (lpString="from") returned 4 [0091.320] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0091.320] malloc (_Size=0xc) returned 0x29eace8 [0091.320] free (_Block=0x29eacd0) [0091.320] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xb7ab9290 | out: _String=0x0, _Context=0xb7ab9290) returned="Win32_ShadowCopy" [0091.320] malloc (_Size=0xc) returned 0x29ead00 [0091.320] free (_Block=0x29eace8) [0091.320] free (_Block=0x29eb6a8) [0091.320] free (_Block=0x29ead00) [0091.320] lstrlenW (lpString="SET") returned 3 [0091.320] lstrlenW (lpString="delete") returned 6 [0091.320] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0091.320] lstrlenW (lpString="CREATE") returned 6 [0091.320] lstrlenW (lpString="delete") returned 6 [0091.320] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0091.320] free (_Block=0x29eae60) [0091.321] malloc (_Size=0x4) returned 0x29eae60 [0091.321] lstrlenW (lpString="GET") returned 3 [0091.321] lstrlenW (lpString="delete") returned 6 [0091.321] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0091.321] lstrlenW (lpString="LIST") returned 4 [0091.321] lstrlenW (lpString="delete") returned 6 [0091.321] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0091.321] lstrlenW (lpString="ASSOC") returned 5 [0091.321] lstrlenW (lpString="delete") returned 6 [0091.321] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0091.321] WbemLocator:IUnknown:AddRef (This=0x2a03708) returned 0x3 [0091.321] free (_Block=0x29e11c8) [0091.321] lstrlenW (lpString="") returned 0 [0091.321] lstrlenW (lpString="NQDPDE") returned 6 [0091.321] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0091.321] lstrlenW (lpString="NQDPDE") returned 6 [0091.321] malloc (_Size=0xe) returned 0x29eaca0 [0091.321] lstrlenW (lpString="NQDPDE") returned 6 [0091.321] GetCurrentThreadId () returned 0x1284 [0091.321] GetCurrentProcess () returned 0xffffffff [0091.321] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x267fc04 | out: TokenHandle=0x267fc04*=0x2f0) returned 1 [0091.321] GetTokenInformation (in: TokenHandle=0x2f0, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x267fc00 | out: TokenInformation=0x0, ReturnLength=0x267fc00) returned 0 [0091.321] malloc (_Size=0x118) returned 0x29eb6a8 [0091.321] GetTokenInformation (in: TokenHandle=0x2f0, TokenInformationClass=0x3, TokenInformation=0x29eb6a8, TokenInformationLength=0x118, ReturnLength=0x267fc00 | out: TokenInformation=0x29eb6a8, ReturnLength=0x267fc00) returned 1 [0091.321] AdjustTokenPrivileges (in: TokenHandle=0x2f0, DisableAllPrivileges=0, NewState=0x29eb6a8*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0091.321] free (_Block=0x29eb6a8) [0091.321] CloseHandle (hObject=0x2f0) returned 1 [0091.321] lstrlenW (lpString="GET") returned 3 [0091.321] lstrlenW (lpString="delete") returned 6 [0091.321] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0091.321] lstrlenW (lpString="LIST") returned 4 [0091.321] lstrlenW (lpString="delete") returned 6 [0091.321] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0091.321] lstrlenW (lpString="SET") returned 3 [0091.321] lstrlenW (lpString="delete") returned 6 [0091.321] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0091.321] lstrlenW (lpString="CALL") returned 4 [0091.321] lstrlenW (lpString="delete") returned 6 [0091.321] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0091.321] lstrlenW (lpString="ASSOC") returned 5 [0091.321] lstrlenW (lpString="delete") returned 6 [0091.321] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0091.321] lstrlenW (lpString="CREATE") returned 6 [0091.321] lstrlenW (lpString="delete") returned 6 [0091.321] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0091.321] lstrlenW (lpString="DELETE") returned 6 [0091.321] lstrlenW (lpString="delete") returned 6 [0091.321] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0091.322] malloc (_Size=0xc) returned 0x29eac58 [0091.322] lstrlenA (lpString="") returned 0 [0091.322] malloc (_Size=0x2) returned 0x29e11c8 [0091.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x132b74, cbMultiByte=-1, lpWideCharStr=0x29e11c8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0091.322] free (_Block=0x29e11c8) [0091.322] malloc (_Size=0xc) returned 0x29ead00 [0091.322] lstrlenA (lpString="") returned 0 [0091.322] malloc (_Size=0x2) returned 0x29e11c8 [0091.322] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x132b74, cbMultiByte=-1, lpWideCharStr=0x29e11c8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0091.322] free (_Block=0x29e11c8) [0091.322] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0091.322] malloc (_Size=0x3e) returned 0x29eb6a8 [0091.322] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0091.322] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xb7ab9528 | out: _String="Select", _Context=0xb7ab9528) returned="Select" [0091.322] malloc (_Size=0xc) returned 0x29eacd0 [0091.322] free (_Block=0x29ead00) [0091.322] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xb7ab9528 | out: _String=0x0, _Context=0xb7ab9528) returned="*" [0091.322] lstrlenW (lpString="FROM") returned 4 [0091.322] lstrlenW (lpString="*") returned 1 [0091.322] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0091.322] malloc (_Size=0xc) returned 0x29eace8 [0091.322] free (_Block=0x29eacd0) [0091.322] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xb7ab9528 | out: _String=0x0, _Context=0xb7ab9528) returned="from" [0091.322] lstrlenW (lpString="FROM") returned 4 [0091.322] lstrlenW (lpString="from") returned 4 [0091.322] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0091.322] malloc (_Size=0xc) returned 0x29ead00 [0091.322] free (_Block=0x29eace8) [0091.322] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xb7ab9528 | out: _String=0x0, _Context=0xb7ab9528) returned="Win32_ShadowCopy" [0091.322] malloc (_Size=0xc) returned 0x29eacd0 [0091.322] free (_Block=0x29ead00) [0091.322] free (_Block=0x29eb6a8) [0091.322] malloc (_Size=0xc) returned 0x29eace8 [0091.323] malloc (_Size=0xc) returned 0x29ead00 [0091.323] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0091.323] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0091.323] free (_Block=0x29eac58) [0091.323] free (_Block=0x29eace8) [0091.323] ??0CHString@@QAE@XZ () returned 0x267fba4 [0091.323] GetCurrentThreadId () returned 0x1284 [0091.323] malloc (_Size=0xc) returned 0x29ead18 [0091.323] malloc (_Size=0xc) returned 0x29eace8 [0091.323] malloc (_Size=0xc) returned 0x29eac58 [0091.323] malloc (_Size=0xc) returned 0x29eac70 [0091.323] malloc (_Size=0xc) returned 0x29eaa48 [0091.323] SysStringLen (param_1="\\\\") returned 0x2 [0091.323] SysStringLen (param_1="NQDPDE") returned 0x6 [0091.324] malloc (_Size=0xc) returned 0x29eabf8 [0091.324] SysStringLen (param_1="\\\\NQDPDE") returned 0x8 [0091.324] SysStringLen (param_1="\\") returned 0x1 [0091.324] malloc (_Size=0xc) returned 0x29eaa78 [0091.324] SysStringLen (param_1="\\\\NQDPDE\\") returned 0x9 [0091.324] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0091.324] free (_Block=0x29eabf8) [0091.324] free (_Block=0x29eaa48) [0091.324] free (_Block=0x29eac70) [0091.324] free (_Block=0x29eac58) [0091.324] free (_Block=0x29eace8) [0091.324] free (_Block=0x29ead18) [0091.324] malloc (_Size=0xc) returned 0x29eace8 [0091.324] malloc (_Size=0xc) returned 0x29ead18 [0091.324] malloc (_Size=0xc) returned 0x29eac58 [0091.324] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2a03708, strNetworkResource="\\\\NQDPDE\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x178564 | out: ppNamespace=0x178564*=0x2a38a28) returned 0x0 [0091.331] free (_Block=0x29eac58) [0091.331] free (_Block=0x29ead18) [0091.331] free (_Block=0x29eace8) [0091.331] CoSetProxyBlanket (pProxy=0x2a38a28, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0091.331] free (_Block=0x29eaa78) [0091.331] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0091.331] ??0CHString@@QAE@XZ () returned 0x267fb94 [0091.331] GetCurrentThreadId () returned 0x1284 [0091.332] malloc (_Size=0xc) returned 0x29eaa48 [0091.332] lstrlenA (lpString="") returned 0 [0091.332] malloc (_Size=0x2) returned 0x29e11c8 [0091.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x132b74, cbMultiByte=-1, lpWideCharStr=0x29e11c8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0091.332] free (_Block=0x29e11c8) [0091.332] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0091.332] SysStringLen (param_1="") returned 0x0 [0091.332] free (_Block=0x29eaa48) [0091.332] malloc (_Size=0xc) returned 0x29eaad8 [0091.332] IWbemServices:ExecQuery (in: This=0x2a38a28, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x267fb90 | out: ppEnum=0x267fb90*=0x0) returned 0x80041014 [0092.211] free (_Block=0x29eaad8) [0092.211] _CxxThrowException () [0092.212] malloc (_Size=0x10) returned 0x29eaa48 [0092.212] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0092.212] free (_Block=0x29eacd0) [0092.212] free (_Block=0x29ead00) [0092.212] GetCurrentThreadId () returned 0x1284 [0092.212] ??0CHString@@QAE@PBG@Z () returned 0x267fc34 [0092.212] ??YCHString@@QAEABV0@PBG@Z () returned 0x267fc34 [0092.213] ??0CHString@@QAE@XZ () returned 0x267fb00 [0092.213] malloc (_Size=0xc) returned 0x29ead00 [0092.213] malloc (_Size=0xc) returned 0x29eacd0 [0092.213] SysStringLen (param_1="") returned 0x0 [0092.213] free (_Block=0x29ead00) [0092.213] CoCreateInstance (in: rclsid=0x136a14*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x136a24*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0x17857c | out: ppv=0x17857c*=0x2a0b858) returned 0x0 [0092.217] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x2a0b858, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x267fb04 | out: MessageText=0x267fb04*="Initialization failure\r\n") returned 0x0 [0092.219] free (_Block=0x29eacd0) [0092.219] malloc (_Size=0xc) returned 0x29ead18 [0092.219] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x2a0b858, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x267fb08 | out: MessageText=0x267fb08*="WMI") returned 0x0 [0092.219] malloc (_Size=0xc) returned 0x29eac58 [0092.219] lstrlenW (lpString="WMI") returned 3 [0092.219] lstrlenW (lpString="Wbem") returned 4 [0092.219] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0092.219] lstrlenW (lpString="WMI") returned 3 [0092.219] lstrlenW (lpString="WMI") returned 3 [0092.220] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0092.220] WbemStatusCodeText:IUnknown:Release (This=0x2a0b858) returned 0x0 [0092.220] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0092.220] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x267f360, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0092.220] FormatMessageW (in: dwFlags=0x2500, lpSource=0x267f360, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x267f348, nSize=0x0, Arguments=0x267f34c | out: lpBuffer="룘ʣ柜ʢ") returned 0x2e [0092.220] malloc (_Size=0xc) returned 0x29eacd0 [0092.220] LocalFree (hMem=0x2a3b8d8) returned 0x0 [0092.220] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0092.220] malloc (_Size=0x2f) returned 0x29eb7a8 [0092.220] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x29eb7a8, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0092.220] __iob_func () returned 0x747d2608 [0092.220] fprintf (in: _File=0x747d2648, _Format="%s" | out: _File=0x747d2648) returned 46 [0092.220] __iob_func () returned 0x747d2608 [0092.220] fflush (in: _File=0x747d2648 | out: _File=0x747d2648) returned 0 [0092.220] free (_Block=0x29eb7a8) [0092.220] free (_Block=0x29eacd0) [0092.221] free (_Block=0x29eac58) [0092.221] free (_Block=0x29ead18) [0092.221] ??1CHString@@QAE@XZ () returned 0x1 [0092.221] ??0CHString@@QAE@PBG@Z () returned 0x267fc3c [0092.221] ??YCHString@@QAEABV0@PBG@Z () returned 0x267fc3c [0092.221] GetCurrentThreadId () returned 0x1284 [0092.221] ??1CHString@@QAE@XZ () returned 0x1 [0092.221] WbemLocator:IUnknown:Release (This=0x2a38a28) returned 0x0 [0092.221] ?Empty@CHString@@QAEXXZ () returned 0x6f2565f8 [0092.221] free (_Block=0x29eaa48) [0092.221] _kbhit () returned 0x0 [0092.222] free (_Block=0x29eae60) [0092.222] free (_Block=0x29ea9b8) [0092.222] free (_Block=0x29ea958) [0092.222] free (_Block=0x29eabc8) [0092.222] free (_Block=0x29eac40) [0092.222] free (_Block=0x29e0578) [0092.222] free (_Block=0x29e2be8) [0092.222] free (_Block=0x29eb670) [0092.222] free (_Block=0x29eac88) [0092.222] free (_Block=0x29eb5f0) [0092.222] free (_Block=0x29eacb8) [0092.222] free (_Block=0x29e2ca8) [0092.222] free (_Block=0x29eb660) [0092.222] free (_Block=0x29e2d00) [0092.223] free (_Block=0x29eb638) [0092.223] ?Empty@CHString@@QAEXXZ () returned 0x6f2565f8 [0092.223] free (_Block=0x29eae30) [0092.223] free (_Block=0x29e2b08) [0092.223] free (_Block=0x29ea9d0) [0092.223] free (_Block=0x29e25d0) [0092.223] free (_Block=0x29e2618) [0092.223] free (_Block=0x29e2660) [0092.223] free (_Block=0x29eaca0) [0092.223] free (_Block=0x29e26f8) [0092.223] free (_Block=0x29e2ce8) [0092.223] free (_Block=0x29e2a48) [0092.223] free (_Block=0x29e04d8) [0092.223] free (_Block=0x29e29e8) [0092.223] free (_Block=0x29e04a0) [0092.223] free (_Block=0x29e04b8) [0092.223] free (_Block=0x29e2838) [0092.223] free (_Block=0x29e2850) [0092.223] free (_Block=0x29e2800) [0092.223] free (_Block=0x29e2818) [0092.223] free (_Block=0x29e2870) [0092.223] free (_Block=0x29e2888) [0092.223] free (_Block=0x29e28a8) [0092.223] free (_Block=0x29e28c0) [0092.223] free (_Block=0x29e2790) [0092.223] free (_Block=0x29e27a8) [0092.223] free (_Block=0x29e2758) [0092.223] free (_Block=0x29e2770) [0092.223] free (_Block=0x29e27c8) [0092.223] free (_Block=0x29e27e0) [0092.223] free (_Block=0x29e2720) [0092.223] free (_Block=0x29e2738) [0092.223] free (_Block=0x29e26d0) [0092.223] free (_Block=0x29e26a8) [0092.223] free (_Block=0x29eada8) [0092.223] WbemLocator:IUnknown:Release (This=0x2a03708) returned 0x2 [0092.223] WbemLocator:IUnknown:Release (This=0x2a38c08) returned 0x0 [0092.224] WbemLocator:IUnknown:Release (This=0x2a0abe0) returned 0x0 [0092.224] WbemLocator:IUnknown:Release (This=0x2a03708) returned 0x1 [0092.224] ?Empty@CHString@@QAEXXZ () returned 0x6f2565f8 [0092.224] WbemLocator:IUnknown:Release (This=0x2a03708) returned 0x0 [0092.224] free (_Block=0x29eab50) [0092.224] free (_Block=0x29eab68) [0092.224] free (_Block=0x29e2ae8) [0092.224] free (_Block=0x29ea988) [0092.224] free (_Block=0x29eab80) [0092.224] free (_Block=0x29e2ba8) [0092.224] free (_Block=0x29ea9a0) [0092.224] free (_Block=0x29eaa30) [0092.224] free (_Block=0x29e2a88) [0092.224] free (_Block=0x29eaaa8) [0092.224] free (_Block=0x29ea9e8) [0092.224] free (_Block=0x29e2c88) [0092.225] free (_Block=0x29eac10) [0092.225] free (_Block=0x29eaa60) [0092.225] free (_Block=0x29e2b68) [0092.225] free (_Block=0x29eaa18) [0092.225] free (_Block=0x29eab98) [0092.225] free (_Block=0x29e2b88) [0092.225] free (_Block=0x29ea970) [0092.225] free (_Block=0x29eabe0) [0092.225] free (_Block=0x29e2cc8) [0092.225] free (_Block=0x29eab08) [0092.225] free (_Block=0x29eaac0) [0092.225] free (_Block=0x29e2a08) [0092.225] free (_Block=0x29e96c8) [0092.225] free (_Block=0x29eaa90) [0092.225] free (_Block=0x29e2b48) [0092.225] free (_Block=0x29eaa00) [0092.225] free (_Block=0x29eaaf0) [0092.225] free (_Block=0x29e2968) [0092.225] free (_Block=0x29eabb0) [0092.225] free (_Block=0x29eab20) [0092.225] free (_Block=0x29e2ac8) [0092.225] free (_Block=0x29eab38) [0092.225] free (_Block=0x29eac28) [0092.225] free (_Block=0x29e2c48) [0092.225] free (_Block=0x29e9650) [0092.225] free (_Block=0x29e9668) [0092.225] free (_Block=0x29e2b28) [0092.225] free (_Block=0x29e95a8) [0092.225] free (_Block=0x29e96e0) [0092.225] free (_Block=0x29e2a68) [0092.225] free (_Block=0x29e95f0) [0092.225] free (_Block=0x29e9728) [0092.225] free (_Block=0x29e2988) [0092.225] free (_Block=0x29e95d8) [0092.225] free (_Block=0x29e9740) [0092.225] free (_Block=0x29e2c08) [0092.225] free (_Block=0x29e9680) [0092.225] free (_Block=0x29e96f8) [0092.225] free (_Block=0x29e2aa8) [0092.226] free (_Block=0x29e9710) [0092.226] free (_Block=0x29e9608) [0092.226] free (_Block=0x29e29a8) [0092.226] free (_Block=0x29e9758) [0092.226] free (_Block=0x29e9620) [0092.226] free (_Block=0x29e2a28) [0092.226] free (_Block=0x29e9638) [0092.226] free (_Block=0x29e9590) [0092.226] free (_Block=0x29e29c8) [0092.226] free (_Block=0x29e9698) [0092.226] free (_Block=0x29e95c0) [0092.226] free (_Block=0x29e2bc8) [0092.226] CoUninitialize () [0092.257] exit (_Code=-2147217388) [0092.257] free (_Block=0x29ead30) [0092.257] free (_Block=0x29e1018) [0092.257] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0092.257] free (_Block=0x29e9770) [0092.257] free (_Block=0x29e2710) [0092.257] free (_Block=0x29e0ff8) [0092.257] free (_Block=0x29e0fd8) [0092.257] free (_Block=0x29e0fa8) [0092.257] free (_Block=0x29e0f88) [0092.257] free (_Block=0x29e0f58) [0092.257] free (_Block=0x29e0f18) [0092.257] free (_Block=0x29e0ef8) [0092.258] ??1CHString@@QAE@XZ () returned 0x6f2565f8 [0092.258] free (_Block=0x29eae70) Thread: id = 17 os_tid = 0xf74 Thread: id = 18 os_tid = 0x19c Thread: id = 19 os_tid = 0x4d4 Thread: id = 20 os_tid = 0x8a0 Process: id = "5" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x47534000" os_pid = "0x170" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000abaa" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 21 os_tid = 0xd00 Thread: id = 22 os_tid = 0x818 Thread: id = 23 os_tid = 0x788 Thread: id = 24 os_tid = 0x6a0 Thread: id = 25 os_tid = 0xaac Thread: id = 26 os_tid = 0x3e4 Thread: id = 27 os_tid = 0xccc Thread: id = 28 os_tid = 0xcd0 Thread: id = 29 os_tid = 0xce0 Thread: id = 30 os_tid = 0xc88 Thread: id = 31 os_tid = 0xfe4 Thread: id = 32 os_tid = 0xf38 Thread: id = 33 os_tid = 0xf28 Thread: id = 34 os_tid = 0xf64 Thread: id = 35 os_tid = 0xd64 Thread: id = 36 os_tid = 0xd70 Thread: id = 37 os_tid = 0xe80 Thread: id = 38 os_tid = 0x10cc Thread: id = 39 os_tid = 0x10c8 Thread: id = 40 os_tid = 0x10c4 Thread: id = 41 os_tid = 0x10c0 Thread: id = 42 os_tid = 0x10bc Thread: id = 43 os_tid = 0x1180 Thread: id = 44 os_tid = 0x1150 Thread: id = 45 os_tid = 0x7ac Thread: id = 46 os_tid = 0x1090 Thread: id = 47 os_tid = 0x13d0 Thread: id = 48 os_tid = 0x12c8 Thread: id = 49 os_tid = 0x12c4 Thread: id = 50 os_tid = 0x12c0 Thread: id = 51 os_tid = 0x12bc Thread: id = 52 os_tid = 0x12b8 Thread: id = 53 os_tid = 0x12b4 Thread: id = 54 os_tid = 0x12ac Thread: id = 55 os_tid = 0x1248 Thread: id = 56 os_tid = 0x1244 Thread: id = 57 os_tid = 0x1240 Thread: id = 58 os_tid = 0x1148 Thread: id = 59 os_tid = 0x1144 Thread: id = 60 os_tid = 0x1140 Thread: id = 61 os_tid = 0x1138 Thread: id = 62 os_tid = 0x1100 Thread: id = 63 os_tid = 0x10fc Thread: id = 64 os_tid = 0x10f8 Thread: id = 65 os_tid = 0x10ec Thread: id = 66 os_tid = 0x10e8 Thread: id = 67 os_tid = 0x10e4 Thread: id = 68 os_tid = 0x10e0 Thread: id = 69 os_tid = 0xeb4 Thread: id = 70 os_tid = 0xea8 Thread: id = 71 os_tid = 0xe88 Thread: id = 72 os_tid = 0xbb4 Thread: id = 73 os_tid = 0xa80 Thread: id = 74 os_tid = 0x9e8 Thread: id = 75 os_tid = 0x9dc Thread: id = 76 os_tid = 0x9d8 Thread: id = 77 os_tid = 0x9d0 Thread: id = 78 os_tid = 0x9cc Thread: id = 79 os_tid = 0x9bc Thread: id = 80 os_tid = 0x9a4 Thread: id = 81 os_tid = 0x9a0 Thread: id = 82 os_tid = 0x998 Thread: id = 83 os_tid = 0x974 Thread: id = 84 os_tid = 0x968 Thread: id = 85 os_tid = 0x95c Thread: id = 86 os_tid = 0x950 Thread: id = 87 os_tid = 0x900 Thread: id = 88 os_tid = 0x8c0 Thread: id = 89 os_tid = 0x878 Thread: id = 90 os_tid = 0x498 Thread: id = 91 os_tid = 0x7dc Thread: id = 92 os_tid = 0x7c8 Thread: id = 93 os_tid = 0x7bc Thread: id = 94 os_tid = 0x794 Thread: id = 95 os_tid = 0x790 Thread: id = 96 os_tid = 0x77c Thread: id = 97 os_tid = 0x770 Thread: id = 98 os_tid = 0x6e4 Thread: id = 99 os_tid = 0x668 Thread: id = 100 os_tid = 0x664 Thread: id = 101 os_tid = 0x660 Thread: id = 102 os_tid = 0x65c Thread: id = 103 os_tid = 0x654 Thread: id = 104 os_tid = 0x648 Thread: id = 105 os_tid = 0x5c4 Thread: id = 106 os_tid = 0x580 Thread: id = 107 os_tid = 0x458 Thread: id = 108 os_tid = 0x440 Thread: id = 109 os_tid = 0x408 Thread: id = 110 os_tid = 0x350 Thread: id = 111 os_tid = 0x184 Thread: id = 112 os_tid = 0x3d8 Thread: id = 113 os_tid = 0x8 Thread: id = 114 os_tid = 0x35c Thread: id = 115 os_tid = 0x390 Thread: id = 116 os_tid = 0x310 Thread: id = 117 os_tid = 0x26c Thread: id = 118 os_tid = 0x290 Thread: id = 119 os_tid = 0x238 Thread: id = 120 os_tid = 0x164 Thread: id = 121 os_tid = 0x198 Thread: id = 177 os_tid = 0x137c Thread: id = 178 os_tid = 0x1384 Thread: id = 180 os_tid = 0x13a0 Thread: id = 181 os_tid = 0x13b0 Thread: id = 182 os_tid = 0x7d4 Thread: id = 243 os_tid = 0xfb4 Thread: id = 244 os_tid = 0x528 Thread: id = 245 os_tid = 0xc70 Process: id = "6" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x72ac2000" os_pid = "0xa34" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e990" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000abaa" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 122 os_tid = 0x10f0 Thread: id = 123 os_tid = 0x68c Thread: id = 124 os_tid = 0x58c Thread: id = 125 os_tid = 0x84 Thread: id = 126 os_tid = 0x3c8 Thread: id = 127 os_tid = 0x190 Thread: id = 128 os_tid = 0x2bc Thread: id = 129 os_tid = 0x850 Process: id = "7" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x3d714000" os_pid = "0xde4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00032069" [0xc000000f] Thread: id = 130 os_tid = 0x114c Thread: id = 131 os_tid = 0x10f4 Thread: id = 132 os_tid = 0xe0c Thread: id = 133 os_tid = 0xe08 Thread: id = 134 os_tid = 0xe04 Thread: id = 135 os_tid = 0xe00 Thread: id = 136 os_tid = 0xdfc Thread: id = 137 os_tid = 0xdf8 Thread: id = 138 os_tid = 0xdf4 Thread: id = 139 os_tid = 0xde8 Process: id = "8" image_name = "wmiprvse.exe" filename = "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" page_root = "0x8c5a000" os_pid = "0x34c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000b3071" [0xc000000f] Thread: id = 140 os_tid = 0xe70 Thread: id = 141 os_tid = 0xf8 Thread: id = 142 os_tid = 0xe98 Thread: id = 143 os_tid = 0x10dc Thread: id = 144 os_tid = 0x10d0 Thread: id = 145 os_tid = 0x109c Thread: id = 146 os_tid = 0x1098 Thread: id = 147 os_tid = 0x10d8 Thread: id = 148 os_tid = 0x10d4 Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7551d000" os_pid = "0x584" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:00010264" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 157 os_tid = 0x840 Thread: id = 158 os_tid = 0x828 Thread: id = 159 os_tid = 0x7f8 Thread: id = 160 os_tid = 0x7f4 Thread: id = 161 os_tid = 0x760 Thread: id = 162 os_tid = 0x67c Thread: id = 163 os_tid = 0x678 Thread: id = 164 os_tid = 0x600 Thread: id = 165 os_tid = 0x5f8 Thread: id = 166 os_tid = 0x5e0 Thread: id = 167 os_tid = 0x588 Process: id = "10" image_name = "notepad.exe" filename = "c:\\windows\\syswow64\\notepad.exe" page_root = "0x2b0c7000" os_pid = "0x1e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x11e0" cmd_line = "\"C:\\WINDOWS\\system32\\NOTEPAD.EXE\" C:\\Users\\FD1HVy\\Desktop\\FILES ENCRYPTED.txt" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 168 os_tid = 0xfd0 Thread: id = 170 os_tid = 0xb7c Thread: id = 173 os_tid = 0xf80 Thread: id = 192 os_tid = 0x1298 Thread: id = 193 os_tid = 0x6fc Process: id = "11" image_name = "mshta.exe" filename = "c:\\windows\\syswow64\\mshta.exe" page_root = "0x31700000" os_pid = "0x764" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x11e0" cmd_line = "\"C:\\Windows\\SysWOW64\\mshta.exe\" \"C:\\Users\\FD1HVy\\Desktop\\Info.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000116db" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 171 os_tid = 0xb38 [0095.052] GetStartupInfoA (in: lpStartupInfo=0xcff978 | out: lpStartupInfo=0xcff978*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\SysWOW64\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0095.052] GetModuleHandleA (lpModuleName=0x0) returned 0xe00000 [0095.053] __set_app_type (_Type=0x2) [0095.053] __p__fmode () returned 0x747d3c14 [0095.053] __p__commode () returned 0x747d49ec [0095.053] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xe01b70) returned 0x0 [0095.066] __getmainargs (in: _Argc=0xe03018, _Argv=0xe0301c, _Env=0xe03020, _DoWildCard=0, _StartInfo=0xe0302c | out: _Argc=0xe03018, _Argv=0xe0301c, _Env=0xe03020) returned 0 [0095.106] SetProcessDEPPolicy (dwFlags=0x1) returned 1 [0095.106] InitOnceExecuteOnce (in: InitOnce=0xe033fc, InitFn=0xe01790, Parameter=0x0, Context=0x0 | out: InitOnce=0xe033fc, Parameter=0x0, Context=0x0) returned 1 [0095.106] GetVersionExA (in: lpVersionInformation=0xe03360*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xe03360*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0095.106] GetVersion () returned 0x3ad7000a [0095.107] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x77190000 [0095.107] GetProcAddress (hModule=0x77190000, lpProcName="HeapSetInformation") returned 0x771a5850 [0095.107] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0095.107] malloc (_Size=0x105) returned 0xdf0f28 [0095.107] malloc (_Size=0x105) returned 0xdf1038 [0095.107] LoadLibraryW (lpLibFileName="WLDP.DLL") returned 0x6f260000 [0095.862] GetProcAddress (hModule=0x6f260000, lpProcName="WldpGetLockdownPolicy") returned 0x6f263c20 [0095.862] WldpGetLockdownPolicy () returned 0x10000000 [0095.862] FreeLibrary (hLibModule=0x6f260000) returned 1 [0095.866] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="clsid\\{25336920-03f9-11cf-8fd0-00aa00686f13}\\InProcServer32", ulOptions=0x0, samDesired=0x1, phkResult=0xcff948 | out: phkResult=0xcff948*=0x136) returned 0x0 [0095.866] RegQueryValueExA (in: hKey=0x136, lpValueName=0x0, lpReserved=0x0, lpType=0xcff940, lpData=0xdf0f28, lpcbData=0xcff934*=0x105 | out: lpType=0xcff940*=0x1, lpData="C:\\Windows\\SysWOW64\\mshtml.dll", lpcbData=0xcff934*=0x1f) returned 0x0 [0095.867] LoadLibraryA (lpLibFileName="C:\\Windows\\SysWOW64\\mshtml.dll") returned 0x6c980000 [0096.944] GetProcessHeap () returned 0x2ea0000 [0096.945] GetVersion () returned 0x3ad7000a [0096.945] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x77190000 [0096.949] GetProcAddress (hModule=0x77190000, lpProcName="HeapSetInformation") returned 0x771a5850 [0096.949] HeapSetInformation (HeapHandle=0x2ea0000, HeapInformationClass=0x0, HeapInformation=0xcff528, HeapInformationLength=0x4) returned 1 [0096.950] malloc (_Size=0x80) returned 0xdf21f0 [0096.951] GetCurrentProcess () returned 0xffffffff [0096.951] GetSystemInfo (in: lpSystemInfo=0x6db41ad0 | out: lpSystemInfo=0x6db41ad0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x4501)) [0096.951] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0096.951] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0096.951] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0096.951] VerifyVersionInfoW (in: lpVersionInformation=0xcff12c, dwTypeMask=0x23, dwlConditionMask=0x1801b | out: lpVersionInformation=0xcff12c) returned 1 [0096.951] GetLogicalProcessorInformation (in: Buffer=0x0, ReturnedLength=0xcff24c | out: Buffer=0x0, ReturnedLength=0xcff24c) returned 0 [0096.951] GetLastError () returned 0x7a [0096.951] GetProcessHeap () returned 0x2ea0000 [0096.951] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xf0) returned 0x2eb37e8 [0096.951] GetLogicalProcessorInformation (in: Buffer=0x2eb37e8, ReturnedLength=0xcff24c | out: Buffer=0x2eb37e8, ReturnedLength=0xcff24c) returned 1 [0096.951] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2eb37e8 | out: hHeap=0x2ea0000) returned 1 [0096.951] GetEnvironmentVariableW (in: lpName="JS_DEBUG_SCOPE", lpBuffer=0xcff264, nSize=0x104 | out: lpBuffer="˫\x02") returned 0x0 [0096.952] __dllonexit () returned 0x6d0e3780 [0096.952] __dllonexit () returned 0x6d0e37a0 [0096.952] __dllonexit () returned 0x6d0e37b0 [0096.953] __dllonexit () returned 0x6d0e3770 [0096.953] __dllonexit () returned 0x6d0e37e0 [0096.953] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x4e20000 [0096.953] __dllonexit () returned 0x6d0e3790 [0096.953] GlobalMemoryStatusEx (in: lpBuffer=0xcff428 | out: lpBuffer=0xcff428) returned 1 [0096.953] __dllonexit () returned 0x6d0e3740 [0096.953] __dllonexit () returned 0x6d0e29b0 [0096.953] __dllonexit () returned 0x6d0e29c0 [0096.953] GetProcessHeap () returned 0x2ea0000 [0096.954] __dllonexit () returned 0x6d0e3820 [0096.954] __dllonexit () returned 0x6d0e3830 [0096.954] __dllonexit () returned 0x6d0e3840 [0096.954] __dllonexit () returned 0x6d0e3850 [0096.954] __dllonexit () returned 0x6d0e29e0 [0096.954] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc0f7 [0096.955] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc0f7 [0096.955] __dllonexit () returned 0x6d0e2a00 [0096.956] __dllonexit () returned 0x6d0e2a20 [0096.956] __dllonexit () returned 0x6d0e2a40 [0096.956] __dllonexit () returned 0x6d0e2a60 [0096.956] __dllonexit () returned 0x6d0e2a90 [0096.956] __dllonexit () returned 0x6d0e2a70 [0096.956] __dllonexit () returned 0x6d0e2aa0 [0096.956] __dllonexit () returned 0x6d0e2a80 [0096.956] __dllonexit () returned 0x6d0e2a50 [0096.956] GlobalMemoryStatusEx (in: lpBuffer=0xcff428 | out: lpBuffer=0xcff428) returned 1 [0096.957] __dllonexit () returned 0x6d0e2ab0 [0096.957] __dllonexit () returned 0x6d0e2ac0 [0096.957] __dllonexit () returned 0x6d0e2ae0 [0096.957] __dllonexit () returned 0x6d0e2b00 [0096.957] __dllonexit () returned 0x6d0e2b20 [0096.957] __dllonexit () returned 0x6d0e2b40 [0096.957] __dllonexit () returned 0x6d0e2b60 [0096.958] __dllonexit () returned 0x6d0e2b80 [0096.958] QueryPerformanceFrequency (in: lpFrequency=0xcff468 | out: lpFrequency=0xcff468*=100000000) returned 1 [0096.958] __dllonexit () returned 0x6d0e2ba0 [0096.958] __dllonexit () returned 0x6d0e2bb0 [0096.958] __dllonexit () returned 0x6d0e2c20 [0096.958] __dllonexit () returned 0x6d0e2be0 [0096.959] __dllonexit () returned 0x6d0e2bf0 [0096.959] __dllonexit () returned 0x6d0e2c00 [0096.959] __dllonexit () returned 0x6d0e2c10 [0096.959] __dllonexit () returned 0x6d0e2bd0 [0096.959] __dllonexit () returned 0x6d0e2c30 [0096.959] __dllonexit () returned 0x6d0e2c50 [0096.959] __dllonexit () returned 0x6d0e2c40 [0096.959] __dllonexit () returned 0x6d0e2c70 [0096.959] __dllonexit () returned 0x6d0e2c90 [0096.959] __dllonexit () returned 0x6d0e2cb0 [0096.959] __dllonexit () returned 0x6d0e2cd0 [0096.959] __dllonexit () returned 0x6d0e2cf0 [0096.959] __dllonexit () returned 0x6d0e2d70 [0096.959] __dllonexit () returned 0x6d0e2d50 [0096.959] __dllonexit () returned 0x6d0e2d30 [0096.959] __dllonexit () returned 0x6d0e2d10 [0096.959] RtlInitializeConditionVariable (in: ConditionVariable=0x6db3f24c | out: ConditionVariable=0x6db3f24c) [0096.959] RtlInitializeConditionVariable (in: ConditionVariable=0x6db3f25c | out: ConditionVariable=0x6db3f25c) [0096.960] __dllonexit () returned 0x6d0e2d90 [0096.960] __dllonexit () returned 0x6d0e2db0 [0096.960] __dllonexit () returned 0x6d0e2dc0 [0096.960] __dllonexit () returned 0x6d0e2dd0 [0096.960] __dllonexit () returned 0x6d0e2df0 [0096.960] __dllonexit () returned 0x6d0e2e10 [0096.960] __dllonexit () returned 0x6d0e2e30 [0096.960] __dllonexit () returned 0x6d0e2e50 [0096.960] __dllonexit () returned 0x6d0e2e70 [0096.960] __dllonexit () returned 0x6d0e2e90 [0096.960] __dllonexit () returned 0x6d0e2eb0 [0096.960] __dllonexit () returned 0x6d0e2ec0 [0096.960] __dllonexit () returned 0x6d0e2ed0 [0096.960] __dllonexit () returned 0x6d0e2ee0 [0096.960] __dllonexit () returned 0x6d0e2ef0 [0096.960] __dllonexit () returned 0x6d0e2f10 [0096.960] __dllonexit () returned 0x6d0e2f20 [0096.961] __dllonexit () returned 0x6d0e2f30 [0096.961] __dllonexit () returned 0x6d0e2f50 [0096.961] __dllonexit () returned 0x6d0e2f70 [0096.961] __dllonexit () returned 0x6d0e2fb0 [0096.961] __dllonexit () returned 0x6d0e2fc0 [0096.961] __dllonexit () returned 0x6d0e3000 [0096.961] __dllonexit () returned 0x6d0e3010 [0096.961] __dllonexit () returned 0x6d0e3020 [0096.961] RtlInitializeConditionVariable (in: ConditionVariable=0x6db499c0 | out: ConditionVariable=0x6db499c0) [0096.961] __dllonexit () returned 0x6d0e3040 [0096.961] __dllonexit () returned 0x6d0e3090 [0096.961] __dllonexit () returned 0x6d0e3050 [0096.961] RtlInitializeConditionVariable (in: ConditionVariable=0x6db3f3ec | out: ConditionVariable=0x6db3f3ec) [0096.961] __dllonexit () returned 0x6d0e3070 [0096.961] __dllonexit () returned 0x6d0e3080 [0096.961] __dllonexit () returned 0x6d0e30c0 [0096.961] __dllonexit () returned 0x6d0e30a0 [0096.961] __dllonexit () returned 0x6d0e30d0 [0096.961] __dllonexit () returned 0x6d0e30f0 [0096.962] __dllonexit () returned 0x6d0e3110 [0096.962] RtlInitializeConditionVariable (in: ConditionVariable=0x6db499ec | out: ConditionVariable=0x6db499ec) [0096.962] __dllonexit () returned 0x6d0e3130 [0096.962] __dllonexit () returned 0x6d0e3150 [0096.962] __dllonexit () returned 0x6d0e3160 [0096.962] __dllonexit () returned 0x6d0e3170 [0096.962] __dllonexit () returned 0x6d0e3180 [0096.962] RtlInitializeConditionVariable (in: ConditionVariable=0x6db499f0 | out: ConditionVariable=0x6db499f0) [0096.962] __dllonexit () returned 0x6d0e3190 [0096.962] __dllonexit () returned 0x6d0e31b0 [0096.962] __dllonexit () returned 0x6d0e31c0 [0096.962] __dllonexit () returned 0x6d0e31d0 [0096.962] __dllonexit () returned 0x6d0e3230 [0096.962] __dllonexit () returned 0x6d0e3220 [0096.962] __dllonexit () returned 0x6d0e31f0 [0096.962] __dllonexit () returned 0x6d0e3210 [0096.963] __dllonexit () returned 0x6d0e3200 [0096.963] __dllonexit () returned 0x6d0e3240 [0096.963] __dllonexit () returned 0x6d0e3260 [0096.963] __dllonexit () returned 0x6d0e3280 [0096.963] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0096.963] __dllonexit () returned 0x6d0e3290 [0096.963] __dllonexit () returned 0x6d0e32b0 [0096.963] __dllonexit () returned 0x6d0e32a0 [0096.990] EtwEventRegister (in: ProviderId=0x6cb36f80, EnableCallback=0x6d0032c0, CallbackContext=0x6da20090, RegHandle=0x6db4adc8 | out: RegHandle=0x6db4adc8) returned 0x0 [0096.997] EtwEventRegister (in: ProviderId=0x6cb36f70, EnableCallback=0x6d0032c0, CallbackContext=0x6da201d8, RegHandle=0x6db42180 | out: RegHandle=0x6db42180) returned 0x0 [0096.997] EtwEventRegister (in: ProviderId=0x6cb36f60, EnableCallback=0x6d0032c0, CallbackContext=0x6da2af60, RegHandle=0x6db42178 | out: RegHandle=0x6db42178) returned 0x0 [0096.997] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xbbf8) returned 0x4e205a8 [0096.997] RtlInitializeSListHead (in: ListHead=0x4e20608 | out: ListHead=0x4e20608) [0096.997] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\ChakraRecycler", ulOptions=0x0, samDesired=0x20019, phkResult=0xcff320 | out: phkResult=0xcff320*=0x0) returned 0x2 [0096.997] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\ChakraRecycler", ulOptions=0x0, samDesired=0x20019, phkResult=0xcff320 | out: phkResult=0xcff320*=0x0) returned 0x2 [0096.997] GetModuleHandleW (lpModuleName=0x0) returned 0xe00000 [0096.997] GetCurrentProcess () returned 0xffffffff [0096.998] GetCurrentProcess () returned 0xffffffff [0096.998] RtlInitializeSListHead (in: ListHead=0x4e20798 | out: ListHead=0x4e20798) [0096.998] RtlInitializeSListHead (in: ListHead=0x4e207b8 | out: ListHead=0x4e207b8) [0096.998] GetCurrentProcess () returned 0xffffffff [0096.998] RtlInitializeSListHead (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) [0096.998] RtlInitializeSListHead (in: ListHead=0x4e20898 | out: ListHead=0x4e20898) [0096.998] GetCurrentProcess () returned 0xffffffff [0096.998] RtlInitializeSListHead (in: ListHead=0x4e20958 | out: ListHead=0x4e20958) [0096.998] RtlInitializeSListHead (in: ListHead=0x4e20978 | out: ListHead=0x4e20978) [0096.998] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x113c) returned 0x4e2c1a8 [0096.998] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x113c) returned 0x4e2d2f0 [0096.998] GetCurrentProcess () returned 0xffffffff [0096.998] GetCurrentProcess () returned 0xffffffff [0096.998] GetCurrentProcess () returned 0xffffffff [0096.998] GetCurrentProcess () returned 0xffffffff [0096.999] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x78) returned 0x4e2e438 [0097.000] rand_s (in: _RandomValue=0xcff2b4 | out: _RandomValue=0xcff2b4) returned 0x0 [0097.000] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0xda0000 [0097.001] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb3f48 [0097.001] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb3f28 [0097.001] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x10) returned 0x2eacf70 [0097.001] __dllonexit () returned 0x6d0e32e0 [0097.001] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4168 [0097.001] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb3f08 [0097.001] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x10) returned 0x2eacda8 [0097.002] __dllonexit () returned 0x6d0e32f0 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb3f68 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb40a8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x10) returned 0x2eacdf0 [0097.002] __dllonexit () returned 0x6d0e32d0 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4208 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb3fc8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb3ec8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4228 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb3f88 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb3ee8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb3fa8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb3fe8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x28) returned 0x2eb2728 [0097.002] __dllonexit () returned 0x6d0e3310 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4248 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb41a8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4008 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4028 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb40c8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4128 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4048 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4188 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x28) returned 0x2eb24b8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4268 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4068 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4148 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb3ea8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4088 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb40e8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4108 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb41c8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x28) returned 0x2eb25a8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb41e8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4898 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb49f8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4758 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb46b8 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4918 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4798 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4a58 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x28) returned 0x2eb2698 [0097.002] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb48b8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4778 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4938 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb46f8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb48d8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb47d8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4958 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4838 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x28) returned 0x2eb25d8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb47f8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4978 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb49d8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4818 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb46d8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4878 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4a38 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4858 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x28) returned 0x2eb2608 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4998 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4718 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb49b8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4738 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4a18 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb48f8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb47b8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4638 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x28) returned 0x2eb2458 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb42f8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb42b8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb42d8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4698 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4578 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4318 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4658 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4558 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x28) returned 0x2eb27e8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb44b8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4598 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4678 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4458 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb45d8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4538 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb4438 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x18) returned 0x2eb43b8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x28) returned 0x2eb26c8 [0097.003] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x28) returned 0x2eb2488 [0097.003] __dllonexit () returned 0x6d0e3300 [0097.003] __dllonexit () returned 0x6d0e3320 [0097.004] __dllonexit () returned 0x6d0e3330 [0097.004] __dllonexit () returned 0x6d0e3340 [0097.004] _CIsqrt () returned 0x4000027f [0097.004] __dllonexit () returned 0x6d0e3360 [0097.004] __dllonexit () returned 0x6d0e3370 [0097.004] __dllonexit () returned 0x6d0e3380 [0097.004] __dllonexit () returned 0x6d0e33a0 [0097.005] __dllonexit () returned 0x6d0e33c0 [0097.005] __dllonexit () returned 0x6d0e33d0 [0097.005] __dllonexit () returned 0x6d0e33f0 [0097.005] __dllonexit () returned 0x6d0e3410 [0097.005] __dllonexit () returned 0x6d0e3430 [0097.005] __dllonexit () returned 0x6d0e3440 [0097.005] RtlInitializeConditionVariable (in: ConditionVariable=0x6db41618 | out: ConditionVariable=0x6db41618) [0097.005] __dllonexit () returned 0x6d0e3450 [0097.006] __dllonexit () returned 0x6d0e3460 [0097.006] __dllonexit () returned 0x6d0e3470 [0097.006] __dllonexit () returned 0x6d0e3480 [0097.034] __dllonexit () returned 0x6d0e3490 [0097.034] __dllonexit () returned 0x6d0e34a0 [0097.034] __dllonexit () returned 0x6d0e34c0 [0097.035] __dllonexit () returned 0x6d0e34f0 [0097.035] __dllonexit () returned 0x6d0e3500 [0097.035] __dllonexit () returned 0x6d0e3530 [0097.035] __dllonexit () returned 0x6d0e3520 [0097.035] __dllonexit () returned 0x6d0e3510 [0097.035] __dllonexit () returned 0x6d0e3540 [0097.035] __dllonexit () returned 0x6d0e3560 [0097.035] __dllonexit () returned 0x6d0e3580 [0097.035] __dllonexit () returned 0x6d0e35c0 [0097.035] __dllonexit () returned 0x6d0e35a0 [0097.035] __dllonexit () returned 0x6d0e35b0 [0097.035] __dllonexit () returned 0x6d0e35d0 [0097.035] __dllonexit () returned 0x6d0e35f0 [0097.036] __dllonexit () returned 0x6d0e3610 [0097.036] __dllonexit () returned 0x6d0e3620 [0097.036] __dllonexit () returned 0x6d0e3640 [0097.036] __dllonexit () returned 0x6d0e3650 [0097.036] __dllonexit () returned 0x6d0e3660 [0097.036] __dllonexit () returned 0x6d0e3670 [0097.036] RtlInitializeConditionVariable (in: ConditionVariable=0x6db49c9c | out: ConditionVariable=0x6db49c9c) [0097.036] RtlInitializeConditionVariable (in: ConditionVariable=0x6db49ca0 | out: ConditionVariable=0x6db49ca0) [0097.036] __dllonexit () returned 0x6d0e3680 [0097.036] __dllonexit () returned 0x6d0e3690 [0097.036] __dllonexit () returned 0x6d0e36a0 [0097.036] __dllonexit () returned 0x6d0e36b0 [0097.036] __dllonexit () returned 0x6d0e36c0 [0097.036] __dllonexit () returned 0x6d0e36e0 [0097.036] __dllonexit () returned 0x6d0e36d0 [0097.038] __dllonexit () returned 0x6d0e36f0 [0097.038] __dllonexit () returned 0x6d0e3710 [0097.038] __dllonexit () returned 0x6d0e3720 [0097.038] RtlInitializeConditionVariable (in: ConditionVariable=0x6db49f18 | out: ConditionVariable=0x6db49f18) [0097.038] __dllonexit () returned 0x6d0e3760 [0097.038] __dllonexit () returned 0x6d0e3750 [0097.038] __dllonexit () returned 0x6d0e37d0 [0097.038] __dllonexit () returned 0x6d0e37f0 [0097.038] __dllonexit () returned 0x6d0e3810 [0097.039] __dllonexit () returned 0x6d0e3860 [0097.039] GetCurrentThreadId () returned 0xb38 [0097.039] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xcff258, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0097.039] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0097.039] StrCmpICW (pszStr1="mshta.exe", pszStr2="IEXPLORE.EXE") returned 4 [0097.039] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSFEEDSSYNC.EXE") returned 2 [0097.039] StrCmpICW (pszStr1="mshta.exe", pszStr2="SYSPREP.EXE") returned -6 [0097.039] StrCmpICW (pszStr1="mshta.exe", pszStr2="EXPLORER.EXE") returned 8 [0097.039] StrCmpICW (pszStr1="mshta.exe", pszStr2="LOADER42.EXE") returned 1 [0097.039] StrCmpICW (pszStr1="mshta.exe", pszStr2="WWAHOST.EXE") returned -10 [0097.039] StrCmpICW (pszStr1="mshta.exe", pszStr2="IEUTLAUNCH.EXE") returned 4 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="TE.EXE") returned -7 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="Te.ProcessHost.exe") returned -7 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="FAKEVIRTUALSURFACETESTAPP.EXE") returned 7 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSOOBE.EXE") returned -7 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="NETPLWIZ.EXE") returned -1 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="USERACCOUNTBROKER.EXE") returned -8 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSHTMPAD.EXE") returned -12 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="FirstLogonAnim.exe") returned 7 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="RESTOREOPTIN.EXE") returned -5 [0097.040] StrStrIW (lpFirst="mshta.exe", lpSrch="DCIScanner") returned 0x0 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="microsoftedge.exe") returned 10 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="microsoftedgecp.exe") returned 10 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="serviceworkerhost.exe") returned -6 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="pickerhost.exe") returned -3 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="msvsmon.exe") returned -14 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="browser_broker.exe") returned 11 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="jshost.exe") returned 3 [0097.040] StrCmpICW (pszStr1="mshta.exe", pszStr2="authhost.exe") returned 12 [0097.040] FindAtomW (lpString="{4653C0A4-2B2D-48DE-AB80-93910A28F900}") returned 0x0 [0097.040] AddAtomW (lpString="{4653C0A4-2B2D-48DE-AB80-93910A28F900}") returned 0xc000 [0097.041] EtwEventRegister (in: ProviderId=0xcff44c, EnableCallback=0x6d036ef0, CallbackContext=0x6da2d6a0, RegHandle=0x6da2d6b8 | out: RegHandle=0x6da2d6b8) returned 0x0 [0097.151] LdrResolveDelayLoadedAPI () returned 0x77572340 [0097.152] EtwEventSetInformation (RegHandle=0x2eaf540, InformationClass=0x1b, EventInformation=0x2, InformationLength=0x6cc01e1c) returned 0x0 [0097.152] LdrResolveDelayLoadedAPI () returned 0x75600d50 [0097.152] CoCreateGuid (in: pguid=0x6db3e1a4 | out: pguid=0x6db3e1a4*(Data1=0x692a213b, Data2=0xde58, Data3=0x4826, Data4=([0]=0x8d, [1]=0x80, [2]=0x76, [3]=0x58, [4]=0x79, [5]=0x18, [6]=0x4f, [7]=0x2b))) returned 0x0 [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44378 | out: ConditionVariable=0x6db44378) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44374 | out: ConditionVariable=0x6db44374) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44370 | out: ConditionVariable=0x6db44370) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db4436c | out: ConditionVariable=0x6db4436c) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44368 | out: ConditionVariable=0x6db44368) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44364 | out: ConditionVariable=0x6db44364) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44360 | out: ConditionVariable=0x6db44360) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db4435c | out: ConditionVariable=0x6db4435c) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44358 | out: ConditionVariable=0x6db44358) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44354 | out: ConditionVariable=0x6db44354) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44350 | out: ConditionVariable=0x6db44350) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db4434c | out: ConditionVariable=0x6db4434c) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44348 | out: ConditionVariable=0x6db44348) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44344 | out: ConditionVariable=0x6db44344) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44340 | out: ConditionVariable=0x6db44340) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db4433c | out: ConditionVariable=0x6db4433c) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44398 | out: ConditionVariable=0x6db44398) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44338 | out: ConditionVariable=0x6db44338) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44334 | out: ConditionVariable=0x6db44334) [0097.153] RtlInitializeConditionVariable (in: ConditionVariable=0x6db44330 | out: ConditionVariable=0x6db44330) [0097.155] LdrResolveDelayLoadedAPI () returned 0x6e973140 [0097.289] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0097.304] InitOnceExecuteOnce (in: InitOnce=0x6db4206c, InitFn=0x6d047fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x6db4206c, Parameter=0x0, Context=0x0) returned 1 [0097.304] GetVersionExA (in: lpVersionInformation=0x6db42070*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6db42070*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0097.304] InitOnceExecuteOnce (in: InitOnce=0x6db4206c, InitFn=0x6d047fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x6db4206c, Parameter=0x0, Context=0x0) returned 1 [0097.306] GetSystemMetrics (nIndex=68) returned 4 [0097.306] GetSystemMetrics (nIndex=69) returned 4 [0097.306] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=20) returned 0x14 [0097.306] GetVersionExW (in: lpVersionInformation=0xcff2bc*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xcff2ac, dwMinorVersion=0x2eb4d10, dwBuildNumber=0xcff510, dwPlatformId=0x77599fd0, szCSDVersion="隼饴锨Ïෘ眝\x02") | out: lpVersionInformation=0xcff2bc*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0097.306] GetUserDefaultUILanguage () returned 0x409 [0097.306] GetLocaleInfoW (in: Locale=0x409, LCType=0x58, lpLCData=0xcff3b0, cchData=16 | out: lpLCData="\x03") returned 16 [0097.306] GetKeyboardLayoutList (in: nBuff=32, lpList=0xcff3e0 | out: lpList=0xcff3e0) returned 1 [0097.306] GetCurrentProcessId () returned 0x764 [0097.306] ProcessIdToSessionId (in: dwProcessId=0x764, pSessionId=0xcff3d0 | out: pSessionId=0xcff3d0) returned 1 [0097.306] WTSGetActiveConsoleSessionId () returned 0x1 [0097.306] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x2e90000 [0097.307] GetVersion () returned 0x3ad7000a [0097.307] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x77190000 [0097.307] GetProcAddress (hModule=0x77190000, lpProcName="HeapSetInformation") returned 0x771a5850 [0097.307] HeapSetInformation (HeapHandle=0x2e90000, HeapInformationClass=0x0, HeapInformation=0xcff460, HeapInformationLength=0x4) returned 1 [0097.307] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0097.307] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0097.307] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0097.307] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0097.307] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0097.308] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x140) returned 0x4e2e4b8 [0097.308] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.308] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x78) returned 0x4e2e600 [0097.308] rand_s (in: _RandomValue=0xcff288 | out: _RandomValue=0xcff288) returned 0x0 [0097.308] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x202000, flProtect=0x4) returned 0x4c50000 [0097.308] VirtualAlloc (lpAddress=0x4c50000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c50000 [0097.310] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x2600) returned 0x4e30048 [0097.311] SystemParametersInfoW (in: uiAction=0x4a, uiParam=0x0, pvParam=0xcff460, fWinIni=0x0 | out: pvParam=0xcff460) returned 1 [0097.311] SystemParametersInfoW (in: uiAction=0x200a, uiParam=0x0, pvParam=0xcff45c, fWinIni=0x0 | out: pvParam=0xcff45c) returned 1 [0097.311] GetCurrentProcessId () returned 0x764 [0097.311] _vsnwprintf (in: _Buffer=0xcff478, _BufferCount=0x16, _Format="%s%08lX", _ArgList=0xcff464 | out: _Buffer="#MSHTML#PERF#00000764") returned 21 [0097.311] OpenFileMappingW (dwDesiredAccess=0x2, bInheritHandle=0, lpName="#MSHTML#PERF#00000764") returned 0x0 [0097.311] EtwEventRegister (in: ProviderId=0x6cb36fd8, EnableCallback=0x6d0032c0, CallbackContext=0x6da28b18, RegHandle=0x6db44328 | out: RegHandle=0x6db44328) returned 0x0 [0097.311] EtwEventSetInformation (RegHandle=0x2eafdb0, InformationClass=0x18, EventInformation=0x2, InformationLength=0x6cb36fc0) returned 0x0 [0097.311] EtwEventRegister (in: ProviderId=0x6cb36fb0, EnableCallback=0x6d0032c0, CallbackContext=0x6da28ae0, RegHandle=0x6db44320 | out: RegHandle=0x6db44320) returned 0x0 [0097.311] EtwEventRegister (in: ProviderId=0x6cb36fa0, EnableCallback=0x6d0032c0, CallbackContext=0x6da28a70, RegHandle=0x6db44310 | out: RegHandle=0x6db44310) returned 0x0 [0097.311] EtwEventRegister (in: ProviderId=0x6cb36f90, EnableCallback=0x6d0032c0, CallbackContext=0x6da28aa8, RegHandle=0x6db44318 | out: RegHandle=0x6db44318) returned 0x0 [0097.311] RegGetValueW (in: hkey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\OUTLOOK.EXE", lpValue="Path", dwFlags=0x2, pdwType=0x0, pvData=0xcff254, pcbData=0xcff250*=0x208 | out: pdwType=0x0, pvData=0xcff254, pcbData=0xcff250*=0x62) returned 0x0 [0097.312] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Program Files\\Microsoft Office\\Root\\Office16\\outllib.dll", lpdwHandle=0xcff24c | out: lpdwHandle=0xcff24c) returned 0x0 [0097.312] GetModuleHandleW (lpModuleName=0x0) returned 0xe00000 [0097.312] GetModuleFileNameW (in: hModule=0xe00000, lpFilename=0xcff258, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0097.312] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0097.312] RegGetValueW (in: hkey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Application Compatibility", lpValue="mshta.exe", dwFlags=0x18, pdwType=0x0, pvData=0xcff254, pcbData=0xcff250*=0x4 | out: pdwType=0x0, pvData=0xcff254, pcbData=0xcff250*=0x4) returned 0x2 [0097.346] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x128) returned 0x4e2e680 [0097.346] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.346] VirtualAlloc (lpAddress=0x4c58000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c58000 [0097.347] _itow_s (in: _Value=0, _Buffer=0xcff44c, _BufferCount=0xa, _Radix=10 | out: _Buffer="0") returned 0x0 [0097.348] _itow_s (in: _Value=1, _Buffer=0xcff44c, _BufferCount=0xa, _Radix=10 | out: _Buffer="1") returned 0x0 [0097.348] _itow_s (in: _Value=2, _Buffer=0xcff44c, _BufferCount=0xa, _Radix=10 | out: _Buffer="2") returned 0x0 [0097.348] _itow_s (in: _Value=3, _Buffer=0xcff44c, _BufferCount=0xa, _Radix=10 | out: _Buffer="3") returned 0x0 [0097.348] _itow_s (in: _Value=4, _Buffer=0xcff44c, _BufferCount=0xa, _Radix=10 | out: _Buffer="4") returned 0x0 [0097.349] GetCurrentProcess () returned 0xffffffff [0097.349] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0xcff3e8, lpExitTime=0xcff3e0, lpKernelTime=0xcff3e0, lpUserTime=0xcff3e0 | out: lpCreationTime=0xcff3e8, lpExitTime=0xcff3e0, lpKernelTime=0xcff3e0, lpUserTime=0xcff3e0) returned 1 [0097.349] free (_Block=0xdf0f28) [0097.349] free (_Block=0xdf1038) [0097.349] RegCloseKey (hKey=0x136) returned 0x0 [0097.349] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x77190000 [0097.349] GetProcAddress (hModule=0x77190000, lpProcName="RegisterApplicationRestart") returned 0x771b1080 [0097.349] malloc (_Size=0xe2) returned 0xdf0f28 [0097.349] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2ea30b8, cbMultiByte=-1, lpWideCharStr=0xdf0f28, cchWideChar=113 | out: lpWideCharStr="\"C:\\Users\\FD1HVy\\Desktop\\Info.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} ") returned 113 [0097.349] RegisterApplicationRestart (pwzCommandline="\"C:\\Users\\FD1HVy\\Desktop\\Info.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} ", dwFlags=0x0) returned 0x0 [0097.350] free (_Block=0xdf0f28) [0097.350] GetProcAddress (hModule=0x6c980000, lpProcName="RunHTMLApplication") returned 0x6d4ea7e0 [0097.352] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0xcff8d0, Length=0x20, ResultLength=0x0 | out: SystemInformation=0xcff8d0, ResultLength=0x0) returned 0x0 [0097.352] GetCommandLineW () returned="\"C:\\Windows\\SysWOW64\\mshta.exe\" \"C:\\Users\\FD1HVy\\Desktop\\Info.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} " [0097.352] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xe6) returned 0x2ea8760 [0097.352] LdrResolveDelayLoadedAPI () returned 0x76ed3e50 [0097.418] OleInitialize (pvReserved=0x0) returned 0x0 [0097.446] IsWindow (hWnd=0x0) returned 0 [0097.446] RegisterClassW (lpWndClass=0xcff894) returned 0xc1af [0097.448] CreateWindowExW (dwExStyle=0x0, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xe00000, lpParam=0x6db3f498) returned 0x202c4 [0097.456] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x24, wParam=0x0, lParam=0xcff44c) returned 0x0 [0097.457] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x81, wParam=0x0, lParam=0xcff440) returned 0x1 [0097.460] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x83, wParam=0x0, lParam=0xcff42c) returned 0x0 [0097.463] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x1, wParam=0x0, lParam=0xcff440) returned 0x0 [0097.465] CreateWindowExW (dwExStyle=0x40000, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x202c4, hMenu=0x0, hInstance=0xe00000, lpParam=0x6db3f498) returned 0x402be [0097.465] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x24, wParam=0x0, lParam=0xcff44c) returned 0x0 [0097.465] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x81, wParam=0x0, lParam=0xcff440) returned 0x1 [0097.466] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x83, wParam=0x0, lParam=0xcff42c) returned 0x0 [0097.466] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x1, wParam=0x0, lParam=0xcff440) returned 0x0 [0097.467] SetWindowLongW (hWnd=0x402be, nIndex=-16, dwNewLong=-2100363264) returned 114229248 [0097.467] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x7c, wParam=0xfffffff0, lParam=0xcff864) returned 0x0 [0097.468] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x7d, wParam=0xfffffff0, lParam=0xcff864) returned 0x0 [0097.470] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0097.470] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0097.471] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0097.471] SetWindowPos (hWnd=0x402be, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0097.471] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x46, wParam=0x0, lParam=0xcff87c) returned 0x0 [0097.471] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x83, wParam=0x1, lParam=0xcff854) returned 0x0 [0097.472] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x47, wParam=0x0, lParam=0xcff87c) returned 0x0 [0097.473] SendMessageW (hWnd=0x402be, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0097.473] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0097.473] NtdllDefWindowProc_W (hWnd=0x402be, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0097.473] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xe6) returned 0x2ec1170 [0097.473] PathGetArgsW (pszPath="\"C:\\Users\\FD1HVy\\Desktop\\Info.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} ") returned="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} " [0097.473] wcsncmp (_String1="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}", _String2="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}", _MaxCount=0x26) returned 0 [0097.473] wcsstr (_Str="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} ", _SubStr="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}") returned="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} " [0097.473] LdrResolveDelayLoadedAPI () returned 0x75a33da0 [0097.473] PathRemoveArgsW (in: pszPath="\"C:\\Users\\FD1HVy\\Desktop\\Info.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}" | out: pszPath="\"C:\\Users\\FD1HVy\\Desktop\\Info.hta\"") [0097.473] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x4a) returned 0x2ea8a00 [0097.473] RtlReAllocateHeap (Heap=0x2ea0000, Flags=0x0, Ptr=0x2ea8a00, Size=0x4c) returned 0x2ea8a00 [0097.473] memcpy_s (in: _Destination=0x2ea8a48, _DestinationSize=0x2, _Source=0x2ec1252, _SourceSize=0x2 | out: _Destination=0x2ea8a48) returned 0x0 [0097.473] RtlReAllocateHeap (Heap=0x2ea0000, Flags=0x0, Ptr=0x2ea8760, Size=0x4c) returned 0x2ea8760 [0097.473] PathRemoveBlanksW (in: pszPath="\"C:\\Users\\FD1HVy\\Desktop\\Info.hta\"" | out: pszPath="\"C:\\Users\\FD1HVy\\Desktop\\Info.hta\"") [0097.473] PathUnquoteSpacesW (in: lpsz="\"C:\\Users\\FD1HVy\\Desktop\\Info.hta\"" | out: lpsz="C:\\Users\\FD1HVy\\Desktop\\Info.hta") returned 1 [0097.474] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ea8a00 | out: hHeap=0x2ea0000) returned 1 [0097.474] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="C:\\Users\\FD1HVy\\Desktop\\Info.hta", ppmk=0xcff8e0*=0x0, dwFlags=0x1 | out: ppmk=0xcff8e0*=0x2ead0f8) returned 0x0 [0097.478] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ec1170 | out: hHeap=0x2ea0000) returned 1 [0097.478] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x10) returned 0x2ebf3b8 [0097.479] CoCreateInstance (in: rclsid=0x6cbc8248*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6cb40548*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x6db3f4ec | out: ppv=0x6db3f4ec*=0x4c70000) returned 0x0 [0097.555] InitOnceExecuteOnce (in: InitOnce=0x6db4206c, InitFn=0x6d047fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x6db4206c, Parameter=0x0, Context=0x0) returned 1 [0097.555] CoIncrementMTAUsage (in: pCookie=0xcfe884 | out: pCookie=0xcfe884) returned 0x0 [0097.555] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x15c) returned 0x4e2e7b0 [0097.555] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.555] VirtualAlloc (lpAddress=0x4c60000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c60000 [0097.556] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x27c) returned 0x4e2e918 [0097.556] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.556] VirtualAlloc (lpAddress=0x4c5a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c5a000 [0097.556] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xb0) returned 0x4e2eba0 [0097.556] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.556] VirtualAlloc (lpAddress=0x4c5c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c5c000 [0097.557] RegisterClassExW (param_1=0xcfe7a8) returned 0xc0f8 [0097.557] CreateWindowExW (dwExStyle=0x8000080, lpClassName=0xc0f8, lpWindowName=0x0, dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x6c980000, lpParam=0x0) returned 0x102ca [0097.559] GetWindowLongW (hWnd=0x102ca, nIndex=-20) returned 134217856 [0097.559] NtdllDefWindowProc_W (hWnd=0x102ca, Msg=0x81, wParam=0x0, lParam=0xcfe3f8) returned 0x1 [0097.559] NtdllDefWindowProc_W (hWnd=0x102ca, Msg=0x83, wParam=0x0, lParam=0xcfe3e4) returned 0x0 [0097.560] NtdllDefWindowProc_W (hWnd=0x102ca, Msg=0x1, wParam=0x0, lParam=0xcfe3f8) returned 0x0 [0097.560] NtdllDefWindowProc_W (hWnd=0x102ca, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0097.560] NtdllDefWindowProc_W (hWnd=0x102ca, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0097.560] ShowWindow (hWnd=0x102ca, nCmdShow=8) returned 0 [0097.560] NtdllDefWindowProc_W (hWnd=0x102ca, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0097.561] NtdllDefWindowProc_W (hWnd=0x102ca, Msg=0x46, wParam=0x0, lParam=0xcfe844) returned 0x0 [0097.563] NtdllDefWindowProc_W (hWnd=0x102ca, Msg=0x47, wParam=0x0, lParam=0xcfe844) returned 0x0 [0097.564] SetWindowPos (hWnd=0x102ca, hWndInsertAfter=0x1, X=0, Y=0, cx=0, cy=0, uFlags=0x13) returned 1 [0097.564] NtdllDefWindowProc_W (hWnd=0x102ca, Msg=0x46, wParam=0x0, lParam=0xcfe82c) returned 0x0 [0097.565] NtdllDefWindowProc_W (hWnd=0x102ca, Msg=0x47, wParam=0x0, lParam=0xcfe82c) returned 0x0 [0097.566] GetModuleHandleW (lpModuleName="ext-ms-win-rtcore-ntuser-window-ext-l1-1-0") returned 0x77260000 [0097.566] GetProcAddress (hModule=0x77260000, lpProcName="SetCoalescableTimer") returned 0x77293c80 [0097.566] CreateCompatibleDC (hdc=0x0) returned 0x70107c6 [0097.567] GetDeviceCaps (hdc=0x70107c6, index=88) returned 96 [0097.567] GetCurrentProcess () returned 0xffffffff [0097.567] GetSystemMetrics (nIndex=1) returned 900 [0097.567] GetSystemMetrics (nIndex=0) returned 1440 [0097.567] GetSystemMetrics (nIndex=68) returned 4 [0097.567] GetSystemMetrics (nIndex=69) returned 4 [0097.567] GetSystemMetrics (nIndex=2) returned 17 [0097.567] GetSystemMetrics (nIndex=3) returned 17 [0097.567] SystemParametersInfoW (in: uiAction=0x29, uiParam=0x1f8, pvParam=0xcfe628, fWinIni=0x0 | out: pvParam=0xcfe628) returned 1 [0097.567] CreateFontIndirectW (lplf=0xcfe7c0) returned 0xa07cb [0097.567] SelectObject (hdc=0x70107c6, h=0xa07cb) returned 0x8a01c2 [0097.567] GetTextMetricsW (in: hdc=0x70107c6, lptm=0xcfe844 | out: lptm=0xcfe844) returned 1 [0097.567] SelectObject (hdc=0x70107c6, h=0x8a01c2) returned 0xa07cb [0097.567] DeleteObject (ho=0xa07cb) returned 1 [0097.568] GetSystemDefaultLCID () returned 0x409 [0097.568] GetUserDefaultLCID () returned 0x409 [0097.568] GetACP () returned 0x4e4 [0097.568] GetLocaleInfoW (in: Locale=0x400, LCType=0x20001014, lpLCData=0xcfe808, cchData=2 | out: lpLCData="\x01") returned 2 [0097.568] GetLocaleInfoW (in: Locale=0x400, LCType=0x13, lpLCData=0xcfe80c, cchData=11 | out: lpLCData="0123456789") returned 11 [0097.568] SystemParametersInfoW (in: uiAction=0x46, uiParam=0x0, pvParam=0x6db4a990, fWinIni=0x0 | out: pvParam=0x6db4a990) returned 1 [0097.568] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0xcfe81c, fWinIni=0x0 | out: pvParam=0xcfe81c) returned 1 [0097.568] LdrResolveDelayLoadedAPI () returned 0x73ef25a0 [0097.568] IsAppThemed () returned 0x1 [0097.568] SystemParametersInfoW (in: uiAction=0x1042, uiParam=0x0, pvParam=0x6da3879c, fWinIni=0x0 | out: pvParam=0x6da3879c) returned 1 [0097.568] SystemParametersInfoW (in: uiAction=0x103e, uiParam=0x0, pvParam=0x6da38798, fWinIni=0x0 | out: pvParam=0x6da38798) returned 1 [0097.569] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x9c) returned 0x4e2ec58 [0097.569] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.569] VirtualAlloc (lpAddress=0x4c5e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c5e000 [0097.569] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xa8) returned 0x4e2ed00 [0097.569] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.569] VirtualAlloc (lpAddress=0x4c68000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c68000 [0097.570] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xe4) returned 0x4e2edb0 [0097.570] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.570] VirtualAlloc (lpAddress=0x4c6a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c6a000 [0097.571] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xd0) returned 0x2eb6dc8 [0097.571] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x268 [0097.571] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x8) returned 0x2ec14c0 [0097.571] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x26c [0097.571] GetCurrentThreadId () returned 0xb38 [0097.571] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xb4) returned 0x4e2eea0 [0097.571] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.571] VirtualAlloc (lpAddress=0x4c6c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c6c000 [0097.572] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x14) returned 0x2ec1d38 [0097.572] GetSystemWindowsDirectoryW (in: lpBuffer=0xcfe6b0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0097.572] CreateActCtxW (pActCtx=0xcfe690) returned 0x2ec56c4 [0097.574] ActivateActCtx (in: hActCtx=0x2ec56c4, lpCookie=0xcfe65c | out: hActCtx=0x2ec56c4, lpCookie=0xcfe65c) returned 1 [0097.574] LoadLibraryExW (lpLibFileName="comctl32.dll", hFile=0x0, dwFlags=0x0) returned 0x6f6e0000 [0097.581] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1ab60001) returned 1 [0097.581] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x304) returned 0x4e32650 [0097.581] GetCurrentProcess () returned 0xffffffff [0097.581] GetCurrentThread () returned 0xfffffffe [0097.581] GetCurrentProcess () returned 0xffffffff [0097.582] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x4e32680, dwDesiredAccess=0x10004a, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x4e32680*=0x27c) returned 1 [0097.582] GetCurrentThreadId () returned 0xb38 [0097.582] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x278 [0097.582] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x280 [0097.582] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x284 [0097.582] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x288 [0097.582] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x28c [0097.582] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x6cf64fe0, _ArgList=0x4e24d50, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x290 [0097.582] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcfe820*=0x288, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0097.598] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x294 [0097.598] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x298 [0097.598] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x6cf64fe0, _ArgList=0x4e24d78, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x29c [0097.599] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcfe820*=0x294, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0097.658] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x6cf63990, _ArgList=0x4e206d8, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x2a0 [0097.659] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcfe844*=0x278, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0097.728] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollDelay", nDefault=50) returned 0x32 [0097.728] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=200) returned 0xc8 [0097.728] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInterval", nDefault=50) returned 0x32 [0097.729] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xcfe6e0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0097.729] PathFindFileNameW (pszPath="C:\\Windows\\SysWOW64\\mshta.exe") returned="mshta.exe" [0097.729] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x14) returned 0x2ec1f58 [0097.729] IsInternetESCEnabled () returned 0x0 [0097.729] RegGetValueW (in: hkey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", lpValue="NoFileMenu", dwFlags=0xffff, pdwType=0xcfe6cc, pvData=0xcfe6d0, pcbData=0xcfe6d4*=0x4 | out: pdwType=0xcfe6cc*=0x0, pvData=0xcfe6d0, pcbData=0xcfe6d4*=0x4) returned 0x2 [0097.730] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x144) returned 0x4e32960 [0097.730] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.730] VirtualAlloc (lpAddress=0x4c70000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c70000 [0097.731] QueryPerformanceFrequency (in: lpFrequency=0xcfe88c | out: lpFrequency=0xcfe88c*=100000000) returned 1 [0097.731] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x17c) returned 0x4e32ab0 [0097.731] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.731] VirtualAlloc (lpAddress=0x4c6e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c6e000 [0097.731] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xd4) returned 0x4e32c38 [0097.731] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.731] VirtualAlloc (lpAddress=0x4c78000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c78000 [0097.731] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x158) returned 0x4e32d18 [0097.731] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.731] VirtualAlloc (lpAddress=0x4c80000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c80000 [0097.732] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0097.732] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0097.732] GetCurrentThreadId () returned 0xb38 [0097.732] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xfc) returned 0x4e32e78 [0097.732] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.732] VirtualAlloc (lpAddress=0x4c7a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c7a000 [0097.732] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xbc) returned 0x4e32f80 [0097.733] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.733] VirtualAlloc (lpAddress=0x4c7c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c7c000 [0097.733] RegisterClipboardFormatW (lpszFormat="WM_HTML_GETOBJECT") returned 0xc0f9 [0097.734] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x6db3cc88, dwReserved=0x0 | out: ppSM=0x6db3cc88*=0x2ec0690) returned 0x0 [0097.735] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xc8) returned 0x4e33048 [0097.736] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.736] VirtualAlloc (lpAddress=0x4c7e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c7e000 [0097.736] InitOnceExecuteOnce (in: InitOnce=0x6db42118, InitFn=0x6d03dde0, Parameter=0x0, Context=0x0 | out: InitOnce=0x6db42118, Parameter=0x0, Context=0x0) returned 1 [0097.736] GetCurrentProcess () returned 0xffffffff [0097.736] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xcfe828 | out: TokenHandle=0xcfe828*=0x2bc) returned 1 [0097.736] LdrResolveDelayLoadedAPI () returned 0x6c95a560 [0097.990] SrpGetEnterpriseIds () returned 0x0 [0097.990] CloseHandle (hObject=0x2bc) returned 1 [0097.990] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x60) returned 0x2ec86b8 [0097.990] GetDoubleClickTime () returned 0x1f4 [0097.991] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInset", nDefault=11) returned 0xb [0097.992] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x14c) returned 0x4e33118 [0097.992] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.992] VirtualAlloc (lpAddress=0x4c88000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c88000 [0097.992] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xa0) returned 0x4e33270 [0097.992] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.992] VirtualAlloc (lpAddress=0x4c90000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c90000 [0097.993] memcpy_s (in: _Destination=0x4c68180, _DestinationSize=0xb8, _Source=0xcfdf40, _SourceSize=0xb8 | out: _Destination=0x4c68180) returned 0x0 [0097.994] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x154) returned 0x4e33318 [0097.994] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.994] VirtualAlloc (lpAddress=0x4c98000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c98000 [0097.994] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x94) returned 0x4e33478 [0097.994] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.994] VirtualAlloc (lpAddress=0x4c92000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c92000 [0097.994] memcpy_s (in: _Destination=0x4c92000, _DestinationSize=0x158, _Source=0xcfe058, _SourceSize=0x158 | out: _Destination=0x4c92000) returned 0x0 [0097.995] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x168) returned 0x4e33518 [0097.996] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.996] VirtualAlloc (lpAddress=0x4ca0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4ca0000 [0097.998] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x90) returned 0x4e33688 [0097.998] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0097.998] VirtualAlloc (lpAddress=0x4c94000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c94000 [0097.998] GetCurrentThreadId () returned 0xb38 [0097.998] LdrResolveDelayLoadedAPI () returned 0x6edfc0d0 [0097.998] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0xcfe3d4 | out: ppURI=0xcfe3d4*=0x2ec1754) returned 0x0 [0097.999] IUri:GetPropertyDWORD (in: This=0x2ec1754, uriProp=0x11, pdwProperty=0xcfe3a4, dwFlags=0x0 | out: pdwProperty=0xcfe3a4*=0x11) returned 0x0 [0097.999] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0xcfe374, dwReserved=0x0 | out: ppSM=0xcfe374*=0x2ec0e90) returned 0x0 [0097.999] IUnknown:QueryInterface (in: This=0x2ec0e90, riid=0x6cb2cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0xcfe378 | out: ppvObject=0xcfe378*=0x2ec0e90) returned 0x0 [0097.999] IUnknown:Release (This=0x2ec0e90) returned 0x1 [0097.999] IInternetSecurityManager:SetSecuritySite (This=0x2ec0e90, pSite=0x4c70e04) returned 0x0 [0097.999] IUnknown:AddRef (This=0x4c70e04) returned 0x28 [0097.999] IUnknown:AddRef (This=0x2ec0e90) returned 0x2 [0098.008] DllGetClassObject (in: rclsid=0x2ead75c*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0xcfd814*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfce24 | out: ppv=0xcfce24*=0x6da2ba90) returned 0x0 [0098.049] IUnknown:AddRef (This=0x6da2ba90) returned 0x1 [0098.049] IUnknown:Release (This=0x6da2ba90) returned 0x1 [0098.049] IUnknown:QueryInterface (in: This=0x6da2ba90, riid=0x6e929214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xcfdacc | out: ppvObject=0xcfdacc*=0x6da2ba90) returned 0x0 [0098.050] IUnknown:Release (This=0x6da2ba90) returned 0x1 [0098.050] IUnknown:QueryInterface (in: This=0x6da2ba90, riid=0x6e92a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfdd1c | out: ppvObject=0xcfdd1c*=0x6da2ba9c) returned 0x0 [0098.051] IUnknown:Release (This=0x6da2ba90) returned 0x1 [0098.051] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0098.051] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0098.063] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x1c) returned 0x2ecac50 [0098.064] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ecac50 | out: hHeap=0x2ea0000) returned 1 [0098.064] IUnknown:Release (This=0x6da2ba9c) returned 0x1 [0098.064] DllGetClassObject (in: rclsid=0x2ead75c*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x6e929214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfd828 | out: ppv=0xcfd828*=0x6da2ba90) returned 0x0 [0098.064] IUnknown:QueryInterface (in: This=0x6da2ba90, riid=0x6e92a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfdd20 | out: ppvObject=0xcfdd20*=0x6da2ba9c) returned 0x0 [0098.064] IUnknown:Release (This=0x6da2ba90) returned 0x1 [0098.064] IInternetProtocolInfo:ParseUrl (in: This=0x6da2ba9c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x2ec2018, cchResult=0xc, pcchResult=0xcfdd1c, dwReserved=0x0 | out: pwzResult="", pcchResult=0xcfdd1c*=0x0) returned 0x800c0011 [0098.064] IUnknown:Release (This=0x6da2ba9c) returned 0x1 [0098.065] IUnknown:Release (This=0x2ec0e90) returned 0x1 [0098.065] IUnknown:Release (This=0x2ec1754) returned 0x3 [0098.065] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x10) returned 0x2ec7628 [0098.065] memcpy_s (in: _Destination=0x2ec7628, _DestinationSize=0x10, _Source=0xcfe438, _SourceSize=0x10 | out: _Destination=0x2ec7628) returned 0x0 [0098.065] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0xcfe40c, dwReserved=0x0 | out: ppSM=0xcfe40c*=0x2ec0810) returned 0x0 [0098.065] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x10) returned 0x2ec75e0 [0098.065] memcpy_s (in: _Destination=0x2ec75e0, _DestinationSize=0x10, _Source=0xcfe438, _SourceSize=0x10 | out: _Destination=0x2ec75e0) returned 0x0 [0098.065] IUnknown:AddRef (This=0x2ec0e90) returned 0x2 [0098.066] IUnknown:Release (This=0x2ec0e90) returned 0x1 [0098.066] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x98) returned 0x4e33720 [0098.066] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0098.066] VirtualAlloc (lpAddress=0x4c96000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c96000 [0098.067] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x8, Size=0x2000) returned 0x2eccfd8 [0098.067] memcpy_s (in: _Destination=0x2eccfd8, _DestinationSize=0x2000, _Source=0xcfe5d8, _SourceSize=0x4 | out: _Destination=0x2eccfd8) returned 0x0 [0098.067] IUnknown:AddRef (This=0x2ec0e90) returned 0x2 [0098.067] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0xcfe3e8 | out: ppURI=0xcfe3e8*=0x2ec1754) returned 0x0 [0098.067] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0098.067] DllGetClassObject (in: rclsid=0x2ead75c*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x6e929214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfdc38 | out: ppv=0xcfdc38*=0x6da2ba90) returned 0x0 [0098.068] IUnknown:QueryInterface (in: This=0x6da2ba90, riid=0x6e92a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfdca4 | out: ppvObject=0xcfdca4*=0x6da2ba9c) returned 0x0 [0098.068] IUnknown:Release (This=0x6da2ba90) returned 0x1 [0098.068] IInternetProtocolInfo:ParseUrl (in: This=0x6da2ba9c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x2ec20f8, cchResult=0xc, pcchResult=0xcfdc9c, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0xcfdc9c*=0xc) returned 0x0 [0098.068] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0098.068] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0098.068] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x1c) returned 0x2ecac50 [0098.068] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ecac50 | out: hHeap=0x2ea0000) returned 1 [0098.068] IUnknown:Release (This=0x6da2ba9c) returned 0x1 [0098.068] DllGetClassObject (in: rclsid=0x2ead75c*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x6e929214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfd7b0 | out: ppv=0xcfd7b0*=0x6da2ba90) returned 0x0 [0098.068] IUnknown:QueryInterface (in: This=0x6da2ba90, riid=0x6e92a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfdca8 | out: ppvObject=0xcfdca8*=0x6da2ba9c) returned 0x0 [0098.068] IUnknown:Release (This=0x6da2ba90) returned 0x1 [0098.068] IInternetProtocolInfo:ParseUrl (in: This=0x6da2ba9c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x2ec20f8, cchResult=0xc, pcchResult=0xcfdca4, dwReserved=0x0 | out: pwzResult="", pcchResult=0xcfdca4*=0x0) returned 0x800c0011 [0098.068] IUnknown:Release (This=0x6da2ba9c) returned 0x1 [0098.068] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0098.069] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0098.069] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x2ec0e90, pUri=0x2ec1754, dwAction=0x2106, pPolicy=0xcfe3dc, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0xcfe3bc | out: pPolicy=0xcfe3dc*=0x0, pdwOutFlags=0xcfe3bc*=0x0) returned 0x0 [0098.069] IUnknown:Release (This=0x2ec0e90) returned 0x1 [0098.069] IUnknown:Release (This=0x2ec1754) returned 0x4 [0098.069] GetDoubleClickTime () returned 0x1f4 [0098.069] GetSystemMetrics (nIndex=36) returned 4 [0098.069] GetSystemMetrics (nIndex=37) returned 4 [0098.070] RtlInitializeConditionVariable (in: ConditionVariable=0x4c580b8 | out: ConditionVariable=0x4c580b8) [0098.070] CoTaskMemAlloc (cb=0x1c) returned 0x2eca958 [0098.070] QISearch (in: that=0x4c58120, pqit=0x6c9ade0c, riid=0x6cb40828*(Data1=0xaf11d3db, Data2=0x81a6, Data3=0x4b88, Data4=([0]=0xae, [1]=0x7, [2]=0x96, [3]=0xec, [4]=0xcf, [5]=0x46, [6]=0xd0, [7]=0x76)), ppv=0x4c710d0 | out: that=0x4c58120, ppv=0x4c710d0*=0x4c58120) returned 0x0 [0098.070] CoTaskMemAlloc (cb=0x1c) returned 0x2eca9d0 [0098.070] QISearch (in: that=0x4c58150, pqit=0x6c9ade0c, riid=0x6cb40828*(Data1=0xaf11d3db, Data2=0x81a6, Data3=0x4b88, Data4=([0]=0xae, [1]=0x7, [2]=0x96, [3]=0xec, [4]=0xcf, [5]=0x46, [6]=0xd0, [7]=0x76)), ppv=0x4c710d4 | out: that=0x4c58150, ppv=0x4c710d4*=0x4c58150) returned 0x0 [0098.070] IUnknown:AddRef (This=0x4c58150) returned 0x2 [0098.070] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x94) returned 0x4e337c0 [0098.070] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0098.070] VirtualAlloc (lpAddress=0x4ca8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4ca8000 [0098.071] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x94) returned 0x4e33860 [0098.071] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0098.071] VirtualAlloc (lpAddress=0x4caa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4caa000 [0098.071] GetSystemTimeAdjustment (in: lpTimeAdjustment=0xcfe870, lpTimeIncrement=0xcfe878, lpTimeAdjustmentDisabled=0xcfe874 | out: lpTimeAdjustment=0xcfe870, lpTimeIncrement=0xcfe878, lpTimeAdjustmentDisabled=0xcfe874) returned 1 [0098.071] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x90) returned 0x4e33900 [0098.071] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0098.071] VirtualAlloc (lpAddress=0x4cac000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4cac000 [0098.071] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe828 | out: lpPerformanceCount=0xcfe828*=19023643647) returned 1 [0098.071] QueryPerformanceFrequency (in: lpFrequency=0x6db41fd8 | out: lpFrequency=0x6db41fd8*=100000000) returned 1 [0098.071] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xa0) returned 0x4e33998 [0098.071] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0098.071] VirtualAlloc (lpAddress=0x4cae000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4cae000 [0098.072] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x46) returned 0x2ebf858 [0098.072] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x42) returned 0x2ebfad8 [0098.072] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x56) returned 0x2eccd88 [0098.073] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x8c) returned 0x4e33a40 [0098.073] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0098.073] VirtualAlloc (lpAddress=0x4cb0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4cb0000 [0098.073] IUnknown:Release (This=0x6da2b52c) returned 0x1 [0098.074] LdrResolveDelayLoadedAPI () returned 0x770b9db0 [0098.074] LdrResolveDelayLoadedAPI () returned 0x744921f0 [0098.074] IUnknown_QueryService (in: punk=0x6db3f4bc, guidService=0x6cb2d374*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x6cb3d07c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvOut=0x4c70060 | out: ppvOut=0x4c70060*=0x0) returned 0x80004005 [0098.074] IUnknown:QueryInterface (in: This=0x6db3f4bc, riid=0x7445b61c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xcff7e0 | out: ppvObject=0xcff7e0*=0x6db3f4d0) returned 0x0 [0098.074] IServiceProvider:QueryService (in: This=0x6db3f4d0, guidService=0x6cb2d374*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x6cb3d07c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvObject=0x4c70060 | out: ppvObject=0x4c70060*=0x0) returned 0x80004005 [0098.074] IUnknown:Release (This=0x6db3f4d0) returned 0x1 [0098.075] IUnknown_QueryService (in: punk=0x6db3f4bc, guidService=0x6cb2d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), riid=0x6cb2d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), ppvOut=0xcff7e4 | out: ppvOut=0xcff7e4*=0x0) returned 0x80004005 [0098.075] IUnknown:QueryInterface (in: This=0x6db3f4bc, riid=0x7445b61c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xcff7a8 | out: ppvObject=0xcff7a8*=0x6db3f4d0) returned 0x0 [0098.075] IServiceProvider:QueryService (in: This=0x6db3f4d0, guidService=0x6cb2d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), riid=0x6cb2d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), ppvObject=0xcff7e4 | out: ppvObject=0xcff7e4*=0x0) returned 0x80004005 [0098.075] IUnknown:Release (This=0x6db3f4d0) returned 0x1 [0098.075] IInternetSecurityManager:SetSecuritySite (This=0x2ec0e90, pSite=0x4c70e04) returned 0x0 [0098.075] IUnknown:Release (This=0x4c70e04) returned 0x0 [0098.075] IUnknown:AddRef (This=0x4c70e04) returned 0x30 [0098.075] IUnknown:QueryInterface (in: This=0x4c70e04, riid=0x6e92a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xcff80c | out: ppvObject=0xcff80c*=0x4c70e08) returned 0x0 [0098.075] IServiceProvider:QueryService (in: This=0x4c70e08, guidService=0x6e92a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), riid=0x6e92a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), ppvObject=0x2ec0ec4 | out: ppvObject=0x2ec0ec4*=0x0) returned 0x80004002 [0098.075] IServiceProvider:QueryService (in: This=0x4c70e08, guidService=0x6e92a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x6e92a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x2ec0ec0 | out: ppvObject=0x2ec0ec0*=0x0) returned 0x80004002 [0098.075] IServiceProvider:QueryService (in: This=0x4c70e08, guidService=0x6e92a5ac*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x6e92a5ac*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x2ec0ebc | out: ppvObject=0x2ec0ebc*=0x0) returned 0x80004002 [0098.075] IServiceProvider:QueryService (in: This=0x4c70e08, guidService=0x6e92a58c*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x6e92a58c*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x2ec0eb8 | out: ppvObject=0x2ec0eb8*=0x6db3f4d4) returned 0x0 [0098.075] IUnknown:Release (This=0x4c70e08) returned 0x0 [0098.075] CoTaskMemAlloc (cb=0x6d) returned 0x2ecb538 [0098.075] CoTaskMemAlloc (cb=0x9) returned 0x2ec7640 [0098.076] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xc) returned 0x2ec7670 [0098.076] StrChrW (lpStart="HTA", wMatch=0x3b) returned 0x0 [0098.076] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xc) returned 0x2ec76d0 [0098.076] memcpy_s (in: _Destination=0x4c6e230, _DestinationSize=0x8, _Source=0x2ec7674, _SourceSize=0x6 | out: _Destination=0x4c6e230) returned 0x0 [0098.076] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x90) returned 0x4e33ad8 [0098.076] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0098.076] VirtualAlloc (lpAddress=0x4cb2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4cb2000 [0098.077] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x20) returned 0x2ecab88 [0098.077] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x98) returned 0x4e33b70 [0098.077] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0098.077] VirtualAlloc (lpAddress=0x4cb4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4cb4000 [0098.077] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x100) returned 0x2ecefe0 [0098.077] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x800) returned 0x2ecf428 [0098.077] IsCharSpaceW (wch=0x48) returned 0 [0098.077] IsCharAlphaNumericW (ch=0x5c) returned 0 [0098.077] IsCharSpaceW (wch=0x5c) returned 0 [0098.078] IsCharSpaceW (wch=0x41) returned 0 [0098.078] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xc) returned 0x2ec7778 [0098.078] IsCharAlphaNumericW (ch=0x20) returned 0 [0098.078] IsCharSpaceW (wch=0x20) returned 1 [0098.078] IsCharSpaceW (wch=0x7b) returned 0 [0098.078] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x1c) returned 0x2ecab60 [0098.078] IsCharSpaceW (wch=0x20) returned 1 [0098.078] IsCharAlphaNumericW (ch=0x7b) returned 0 [0098.078] IsCharSpaceW (wch=0x62) returned 0 [0098.078] IsCharAlphaNumericW (ch=0x3a) returned 0 [0098.078] IsCharSpaceW (wch=0x3a) returned 0 [0098.078] IsCharAlphaNumericW (ch=0x3a) returned 0 [0098.078] IsCharSpaceW (wch=0x75) returned 0 [0098.078] IsCharAlphaNumericW (ch=0x28) returned 0 [0098.078] IsCharSpaceW (wch=0x28) returned 0 [0098.078] IsCharAlphaNumericW (ch=0x28) returned 0 [0098.078] IsCharSpaceW (wch=0x23) returned 0 [0098.078] IsCharSpaceW (wch=0x23) returned 0 [0098.079] IsCharSpaceW (wch=0x7d) returned 0 [0098.079] IsCharAlphaNumericW (ch=0x7d) returned 0 [0098.079] IsCharSpaceW (wch=0x29) returned 0 [0098.079] IsCharSpaceW (wch=0x75) returned 0 [0098.079] IsCharSpaceW (wch=0x75) returned 0 [0098.079] IsCharSpaceW (wch=0x29) returned 0 [0098.079] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x34) returned 0x2ead4f8 [0098.079] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x2) returned 0x2ec1730 [0098.079] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x10) returned 0x2ec76e8 [0098.079] CoTaskMemFree (pv=0x2ecb538) [0098.079] CoTaskMemFree (pv=0x2ec7640) [0098.080] wcsncmp (_String1="HKCU\\", _String2="HKCU\\", _MaxCount=0x5) returned 0 [0098.080] StrCmpCW (pszStr1="Software\\Microsoft\\Internet Explorer", pszStr2="Software\\Microsoft\\Windows Mail\\Trident") returned -14 [0098.080] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x4a) returned 0x2ecb538 [0098.080] GetSysColor (nIndex=26) returned 0xcc6600 [0098.080] GetSysColor (nIndex=5) returned 0xffffff [0098.080] GetSysColor (nIndex=8) returned 0x0 [0098.080] GetSysColor (nIndex=26) returned 0xcc6600 [0098.080] GetSysColor (nIndex=5) returned 0xffffff [0098.080] GetSysColor (nIndex=8) returned 0x0 [0098.082] wcstol (in: _String="0,0,255", _EndPtr=0xcfd438, _Radix=10 | out: _EndPtr=0xcfd438*=",0,255") returned 0 [0098.083] wcstol (in: _String="0,255", _EndPtr=0xcfd438, _Radix=10 | out: _EndPtr=0xcfd438*=",255") returned 0 [0098.083] wcstol (in: _String="255", _EndPtr=0xcfd438, _Radix=10 | out: _EndPtr=0xcfd438*="") returned 255 [0098.083] wcstol (in: _String="128,0,128", _EndPtr=0xcfd438, _Radix=10 | out: _EndPtr=0xcfd438*=",0,128") returned 128 [0098.083] wcstol (in: _String="0,128", _EndPtr=0xcfd438, _Radix=10 | out: _EndPtr=0xcfd438*=",128") returned 0 [0098.083] wcstol (in: _String="128", _EndPtr=0xcfd438, _Radix=10 | out: _EndPtr=0xcfd438*="") returned 128 [0098.085] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x3a) returned 0x2ec43a8 [0098.086] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x9a) returned 0x2ecf0e8 [0098.192] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x26) returned 0x2ec3000 [0098.193] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x9e) returned 0x2ed39a0 [0098.193] GetProcessHeap () returned 0x2ea0000 [0098.193] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ead778 | out: hHeap=0x2ea0000) returned 1 [0098.193] GetProcessHeap () returned 0x2ea0000 [0098.193] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ead278 | out: hHeap=0x2ea0000) returned 1 [0098.193] GetProcessHeap () returned 0x2ea0000 [0098.193] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ec1650 | out: hHeap=0x2ea0000) returned 1 [0098.194] _ltow_s (in: _Value=3, _Buffer=0xcfd540, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0098.194] _ltow_s (in: _Value=3, _Buffer=0xcfd540, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0098.194] _ltow_s (in: _Value=3, _Buffer=0xcfd540, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0098.194] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x24) returned 0x2ec3090 [0098.194] _ltow_s (in: _Value=3, _Buffer=0xcfd540, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0098.194] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x1c) returned 0x2ecaa48 [0098.194] _ltow_s (in: _Value=3, _Buffer=0xcfd540, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0098.194] _ltow_s (in: _Value=3, _Buffer=0xcfd540, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0098.195] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x10) returned 0x2ec74d8 [0098.195] _ltow_s (in: _Value=3, _Buffer=0xcfd540, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0098.195] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x16) returned 0x2ec2258 [0098.195] GetAcceptLanguagesW () returned 0x0 [0098.195] LocaleNameToLCID (lpName="en-US", dwFlags=0x8000000) returned 0x409 [0098.195] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x10) returned 0x2ec7820 [0098.195] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xb0) returned 0x2ed3a48 [0098.195] LCIDToLocaleName (in: Locale=0x409, lpName=0x2ed3a4c, cchName=85, dwFlags=0x8000000 | out: lpName="en-US") returned 6 [0098.195] RtlReAllocateHeap (Heap=0x2ea0000, Flags=0x0, Ptr=0x2ec7820, Size=0xb0) returned 0x2ed3b00 [0098.195] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ed3a48 | out: hHeap=0x2ea0000) returned 1 [0098.195] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x10) returned 0x2ec7820 [0098.195] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ed3b00 | out: hHeap=0x2ea0000) returned 1 [0098.196] memcpy_s (in: _Destination=0xcfe808, _DestinationSize=0x1000, _Source=0x6db3f084, _SourceSize=0xc | out: _Destination=0xcfe808) returned 0x0 [0098.196] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x10) returned 0x2ec7838 [0098.196] GetClassNameW (in: hWnd=0x402be, lpClassName=0xcff7fc, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0098.196] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0098.196] GetParent (hWnd=0x402be) returned 0x202c4 [0098.196] GetClassNameW (in: hWnd=0x202c4, lpClassName=0xcff7fc, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0098.196] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0098.196] GetParent (hWnd=0x202c4) returned 0x0 [0098.196] memcpy_s (in: _Destination=0x4c6e350, _DestinationSize=0x6, _Source=0x6cb2eb7c, _SourceSize=0x4 | out: _Destination=0x4c6e350) returned 0x0 [0098.196] memcpy_s (in: _Destination=0x4c6e370, _DestinationSize=0xc, _Source=0x6cb2eb70, _SourceSize=0xa | out: _Destination=0x4c6e370) returned 0x0 [0098.196] memcpy_s (in: _Destination=0x4c6e390, _DestinationSize=0xa, _Source=0x6cb2eb64, _SourceSize=0x8 | out: _Destination=0x4c6e390) returned 0x0 [0098.197] memcpy_s (in: _Destination=0x4c6e3b0, _DestinationSize=0xc, _Source=0x6cb2eb58, _SourceSize=0xa | out: _Destination=0x4c6e3b0) returned 0x0 [0098.197] memcpy_s (in: _Destination=0x4c6e3d0, _DestinationSize=0x6, _Source=0x6cb2eb50, _SourceSize=0x4 | out: _Destination=0x4c6e3d0) returned 0x0 [0098.197] memcpy_s (in: _Destination=0x4c6e3f0, _DestinationSize=0x8, _Source=0x6cb2eb48, _SourceSize=0x6 | out: _Destination=0x4c6e3f0) returned 0x0 [0098.197] memcpy_s (in: _Destination=0x4c6e410, _DestinationSize=0x6, _Source=0x6cb2eb40, _SourceSize=0x4 | out: _Destination=0x4c6e410) returned 0x0 [0098.197] memcpy_s (in: _Destination=0x4c6e430, _DestinationSize=0x8, _Source=0x6cb2eb38, _SourceSize=0x6 | out: _Destination=0x4c6e430) returned 0x0 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x1c) returned 0x2ecaa70 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x1c) returned 0x2ecaa98 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x1a) returned 0x2ecabb0 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x1a) returned 0x2ecabd8 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x1a) returned 0x2ecac00 [0098.197] _ltow_s (in: _Value=0, _Buffer=0xcff4b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="0") returned 0x0 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x12) returned 0x2ec1ff8 [0098.197] _ltow_s (in: _Value=5, _Buffer=0xcff4b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="5") returned 0x0 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x12) returned 0x2ec2058 [0098.197] _ltow_s (in: _Value=7, _Buffer=0xcff4b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="7") returned 0x0 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x12) returned 0x2ec2158 [0098.197] _ltow_s (in: _Value=8, _Buffer=0xcff4b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="8") returned 0x0 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x12) returned 0x2ec2118 [0098.197] _ltow_s (in: _Value=9, _Buffer=0xcff4b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="9") returned 0x0 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x12) returned 0x2ec22f8 [0098.197] _ltow_s (in: _Value=10, _Buffer=0xcff4b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="10") returned 0x0 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x14) returned 0x2ec21d8 [0098.197] _ltow_s (in: _Value=11, _Buffer=0xcff4b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="11") returned 0x0 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x14) returned 0x2ec1fd8 [0098.197] _ltow_s (in: _Value=12, _Buffer=0xcff4b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="12") returned 0x0 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x14) returned 0x2ec2338 [0098.197] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x12) returned 0x2ec2038 [0098.198] memcpy_s (in: _Destination=0x4c6e450, _DestinationSize=0x6, _Source=0x2ec15b0, _SourceSize=0x4 | out: _Destination=0x4c6e450) returned 0x0 [0098.198] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xc) returned 0x2ec7520 [0098.198] memcpy_s (in: _Destination=0x4c6e470, _DestinationSize=0x8, _Source=0x2ec1680, _SourceSize=0x6 | out: _Destination=0x4c6e470) returned 0x0 [0098.198] GetProcessHeap () returned 0x2ea0000 [0098.198] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ec15b0 | out: hHeap=0x2ea0000) returned 1 [0098.198] GetProcessHeap () returned 0x2ea0000 [0098.198] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ec1680 | out: hHeap=0x2ea0000) returned 1 [0098.198] GetProcessHeap () returned 0x2ea0000 [0098.198] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ec1660 | out: hHeap=0x2ea0000) returned 1 [0098.198] IMoniker:GetDisplayName (in: This=0x2ead0f8, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0xcff864 | out: ppszDisplayName=0xcff864*="file:///C:/Users/FD1HVy/Desktop/Info.hta") returned 0x0 [0098.198] IUnknown:QueryInterface (in: This=0x2ead0f8, riid=0x6cb7e2f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0xcff784 | out: ppvObject=0xcff784*=0x2ead104) returned 0x0 [0098.198] IUriContainer:GetIUri (in: This=0x2ead104, ppIUri=0xcff860 | out: ppIUri=0xcff860*=0x2ec1ad4) returned 0x0 [0098.198] IUnknown:Release (This=0x2ead104) returned 0x1 [0098.198] IUnknown:AddRef (This=0x2ead0f8) returned 0x2 [0098.198] IUnknown:AddRef (This=0x2ec1ad4) returned 0x6 [0098.199] IMoniker:GetDisplayName (in: This=0x2ead0f8, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0xcff674 | out: ppszDisplayName=0xcff674*="file:///C:/Users/FD1HVy/Desktop/Info.hta") returned 0x0 [0098.199] UrlGetLocationW (psz1="file:///C:/Users/FD1HVy/Desktop/Info.hta") returned 0x0 [0098.199] UrlGetLocationW (psz1=0x0) returned 0x0 [0098.199] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="file:///C:/Users/FD1HVy/Desktop/Info.hta", ppmk=0xcff618*=0x0, dwFlags=0x1 | out: ppmk=0xcff618*=0x2ead7b8) returned 0x0 [0098.199] CreateUri (in: pwzURI="file:///C:/Users/FD1HVy/Desktop/Info.hta", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0xcff604 | out: ppURI=0xcff604*=0x2ed3a54) returned 0x0 [0098.199] IUri:GetScheme (in: This=0x2ed3a54, pdwScheme=0xcff59c | out: pdwScheme=0xcff59c*=0x9) returned 0x0 [0098.199] CoInternetIsFeatureEnabled (FeatureEntry=0x1, dwFlags=0x2) returned 0x1 [0098.199] IUnknown:AddRef (This=0x2ed3a54) returned 0x6 [0098.199] IUri:GetAbsoluteUri (in: This=0x2ed3a54, pbstrAbsoluteUri=0x4c58240 | out: pbstrAbsoluteUri=0x4c58240*="file:///C:/Users/FD1HVy/Desktop/Info.hta") returned 0x0 [0098.200] IUnknown:Release (This=0x2ed3a54) returned 0x5 [0098.200] IUnknown:AddRef (This=0x2ead7b8) returned 0x2 [0098.200] IUnknown:Release (This=0x2ead7b8) returned 0x1 [0098.200] IUnknown:AddRef (This=0x2ead0f8) returned 0x3 [0098.200] IUnknown:Release (This=0x2ead7b8) returned 0x0 [0098.200] CoInternetIsFeatureEnabled (FeatureEntry=0x15, dwFlags=0x2) returned 0x1 [0098.200] IUnknown:AddRef (This=0x2ead0f8) returned 0x4 [0098.200] IUnknown:QueryInterface (in: This=0x2ec1ad4, riid=0x6cb40c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff1a8 | out: ppvObject=0xcff1a8*=0x2ec1ad4) returned 0x0 [0098.200] IUnknown:Release (This=0x2ec1ad4) returned 0x6 [0098.200] IUnknown:AddRef (This=0x2ec1ad4) returned 0x7 [0098.200] IUnknown:QueryInterface (in: This=0x2ead0f8, riid=0x6cb7e2f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0xcff180 | out: ppvObject=0xcff180*=0x2ead104) returned 0x0 [0098.200] IUriContainer:GetIUri (in: This=0x2ead104, ppIUri=0xcff428 | out: ppIUri=0xcff428*=0x2ec1ad4) returned 0x0 [0098.200] IUnknown:Release (This=0x2ead104) returned 0x4 [0098.200] IUnknown:AddRef (This=0x2ead0f8) returned 0x5 [0098.200] IUnknown:Release (This=0x2ead0f8) returned 0x4 [0098.201] IUnknown:AddRef (This=0x2ec1ad4) returned 0x9 [0098.201] IUnknown:QueryInterface (in: This=0x2ec1ad4, riid=0x6cb40c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff1a8 | out: ppvObject=0xcff1a8*=0x2ec1ad4) returned 0x0 [0098.201] IUnknown:Release (This=0x2ec1ad4) returned 0x9 [0098.201] IUnknown:AddRef (This=0x2ec1ad4) returned 0xa [0098.201] IUri:GetScheme (in: This=0x2ec1ad4, pdwScheme=0xcff1bc | out: pdwScheme=0xcff1bc*=0x9) returned 0x0 [0098.201] GetCurrentProcessId () returned 0x764 [0098.201] GetCurrentProcessId () returned 0x764 [0098.201] IUnknown:QueryInterface (in: This=0x2ec1ad4, riid=0x6cb40c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff1a8 | out: ppvObject=0xcff1a8*=0x2ec1ad4) returned 0x0 [0098.201] IUnknown:Release (This=0x2ec1ad4) returned 0xa [0098.201] IUnknown:AddRef (This=0x2ec1ad4) returned 0xb [0098.201] IUri:GetScheme (in: This=0x2ec1ad4, pdwScheme=0xcff190 | out: pdwScheme=0xcff190*=0x9) returned 0x0 [0098.201] IUnknown:QueryInterface (in: This=0x2ec1ad4, riid=0x6cb40c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff128 | out: ppvObject=0xcff128*=0x2ec1ad4) returned 0x0 [0098.201] IUnknown:Release (This=0x2ec1ad4) returned 0xb [0098.201] IUnknown:AddRef (This=0x2ec1ad4) returned 0xc [0098.201] IUnknown:Release (This=0x2ec1ad4) returned 0xb [0098.201] IUri:GetAbsoluteUri (in: This=0x2ec1ad4, pbstrAbsoluteUri=0xcff1b4 | out: pbstrAbsoluteUri=0xcff1b4*="file:///C:/Users/FD1HVy/Desktop/Info.hta") returned 0x0 [0098.201] SysStringLen (param_1="file:///C:/Users/FD1HVy/Desktop/Info.hta") returned 0x28 [0098.201] CreateUri (in: pwzURI="file:///C:/Users/FD1HVy/Desktop/Info.hta", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0xcff414 | out: ppURI=0xcff414*=0x2ed3cc4) returned 0x0 [0098.202] IUnknown:Release (This=0x2ec1ad4) returned 0xa [0098.202] IUri:GetScheme (in: This=0x2ed3cc4, pdwScheme=0xcff16c | out: pdwScheme=0xcff16c*=0x9) returned 0x0 [0098.202] IUri:IsEqual (in: This=0x2ed3a54, pUri=0x2ed3cc4, pfEqual=0xcff1bc | out: pfEqual=0xcff1bc*=1) returned 0x0 [0098.202] IUnknown:AddRef (This=0x2ed3a54) returned 0x4 [0098.202] IUri:GetPropertyDWORD (in: This=0x2ed3a54, uriProp=0x11, pdwProperty=0xcfef2c, dwFlags=0x0 | out: pdwProperty=0xcfef2c*=0x9) returned 0x0 [0098.202] IUnknown:Release (This=0x2ed3a54) returned 0x3 [0098.202] IUnknown:AddRef (This=0x2ec0e90) returned 0x2 [0098.202] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x56) returned 0x2ed3e58 [0098.202] IUnknown:QueryInterface (in: This=0x6db3f4d4, riid=0x6e92a5cc*(Data1=0xc90db44a, Data2=0x1902, Data3=0x451e, Data4=([0]=0xbd, [1]=0xf0, [2]=0x5c, [3]=0x89, [4]=0x66, [5]=0xb, [6]=0x52, [7]=0x8c)), ppvObject=0xcfce98 | out: ppvObject=0xcfce98*=0x0) returned 0x80004002 [0098.211] IUnknown:Release (This=0x2ec0e90) returned 0x1 [0098.211] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ed3e58 | out: hHeap=0x2ea0000) returned 1 [0098.211] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ec7628 | out: hHeap=0x2ea0000) returned 1 [0098.211] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xa) returned 0x2eb9228 [0098.211] memcpy_s (in: _Destination=0x2eb9228, _DestinationSize=0xa, _Source=0xcfefb8, _SourceSize=0xa | out: _Destination=0x2eb9228) returned 0x0 [0098.211] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2ec75e0 | out: hHeap=0x2ea0000) returned 1 [0098.211] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xa) returned 0x2eb92a0 [0098.211] memcpy_s (in: _Destination=0x2eb92a0, _DestinationSize=0xa, _Source=0xcfefb8, _SourceSize=0xa | out: _Destination=0x2eb92a0) returned 0x0 [0098.211] ParseURLW (in: pcszURL="file:///C:/Users/FD1HVy/Desktop/Info.hta", ppu=0xcff170 | out: ppu=0xcff170) returned 0x0 [0098.211] GetDC (hWnd=0x0) returned 0x2c010660 [0098.211] CreateCompatibleBitmap (hdc=0x2c010660, cx=1, cy=1) returned 0x20507cf [0098.211] GetDIBits (in: hdc=0x2c010660, hbm=0x20507cf, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0xcfed40, usage=0x0 | out: lpvBits=0x0, lpbmi=0xcfed40) returned 1 [0098.211] GetDIBits (in: hdc=0x2c010660, hbm=0x20507cf, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0xcfed40, usage=0x0 | out: lpvBits=0x0, lpbmi=0xcfed40) returned 1 [0098.211] DeleteObject (ho=0x20507cf) returned 1 [0098.211] GetSysColor (nIndex=0) returned 0xc8c8c8 [0098.211] GetSysColor (nIndex=1) returned 0x0 [0098.211] GetSysColor (nIndex=2) returned 0xd1b499 [0098.211] GetSysColor (nIndex=3) returned 0xdbcdbf [0098.211] GetSysColor (nIndex=4) returned 0xf0f0f0 [0098.211] GetSysColor (nIndex=5) returned 0xffffff [0098.211] GetSysColor (nIndex=6) returned 0x646464 [0098.211] GetSysColor (nIndex=7) returned 0x0 [0098.211] GetSysColor (nIndex=8) returned 0x0 [0098.211] GetSysColor (nIndex=9) returned 0x0 [0098.211] GetSysColor (nIndex=10) returned 0xb4b4b4 [0098.211] GetSysColor (nIndex=11) returned 0xfcf7f4 [0098.211] GetSysColor (nIndex=12) returned 0xababab [0098.211] GetSysColor (nIndex=13) returned 0xd77800 [0098.211] GetSysColor (nIndex=14) returned 0xffffff [0098.211] GetSysColor (nIndex=15) returned 0xf0f0f0 [0098.211] GetSysColor (nIndex=16) returned 0xa0a0a0 [0098.211] GetSysColor (nIndex=17) returned 0x6d6d6d [0098.211] GetSysColor (nIndex=18) returned 0x0 [0098.211] GetSysColor (nIndex=19) returned 0x0 [0098.211] GetSysColor (nIndex=20) returned 0xffffff [0098.211] GetSysColor (nIndex=21) returned 0x696969 [0098.211] GetSysColor (nIndex=22) returned 0xe3e3e3 [0098.212] GetSysColor (nIndex=23) returned 0x0 [0098.212] GetSysColor (nIndex=24) returned 0xe1ffff [0098.212] GetSysColor (nIndex=25) returned 0x0 [0098.212] GetSysColor (nIndex=26) returned 0xcc6600 [0098.212] GetSysColor (nIndex=27) returned 0xead1b9 [0098.212] GetSysColor (nIndex=28) returned 0xf2e4d7 [0098.212] GetSysColor (nIndex=29) returned 0xd77800 [0098.212] GetSysColor (nIndex=30) returned 0xf0f0f0 [0098.212] GetSysColor (nIndex=31) returned 0x0 [0098.212] GetSysColor (nIndex=32) returned 0x0 [0098.212] GetSysColor (nIndex=33) returned 0x0 [0098.212] GetSysColor (nIndex=34) returned 0x0 [0098.212] GetSysColor (nIndex=35) returned 0x0 [0098.212] GetSysColor (nIndex=36) returned 0x0 [0098.212] GetSysColor (nIndex=37) returned 0x0 [0098.212] GetSysColor (nIndex=38) returned 0x0 [0098.212] GetSysColor (nIndex=39) returned 0x0 [0098.212] GetSysColor (nIndex=40) returned 0x0 [0098.212] GetSysColor (nIndex=41) returned 0x0 [0098.212] GetSysColor (nIndex=42) returned 0x0 [0098.212] GetSysColor (nIndex=43) returned 0x0 [0098.212] GetSysColor (nIndex=44) returned 0x0 [0098.212] GetSysColor (nIndex=45) returned 0x0 [0098.212] GetSysColor (nIndex=46) returned 0x0 [0098.212] GetSysColor (nIndex=47) returned 0x0 [0098.212] GetSysColor (nIndex=48) returned 0x0 [0098.212] GetSysColor (nIndex=49) returned 0x0 [0098.212] GetSysColor (nIndex=50) returned 0x0 [0098.212] GetSysColor (nIndex=51) returned 0x0 [0098.212] GetSysColor (nIndex=52) returned 0x0 [0098.212] GetSysColor (nIndex=53) returned 0x0 [0098.212] GetSysColor (nIndex=54) returned 0x0 [0098.212] GetSysColor (nIndex=55) returned 0x0 [0098.212] GetSysColor (nIndex=56) returned 0x0 [0098.212] GetSysColor (nIndex=57) returned 0x0 [0098.212] GetSysColor (nIndex=58) returned 0x0 [0098.212] GetSysColor (nIndex=59) returned 0x0 [0098.212] GetSysColor (nIndex=60) returned 0x0 [0098.212] GetSysColor (nIndex=61) returned 0x0 [0098.212] GetSysColor (nIndex=62) returned 0x0 [0098.212] GetSysColor (nIndex=63) returned 0x0 [0098.212] GetDeviceCaps (hdc=0x2c010660, index=38) returned 32409 [0098.212] ReleaseDC (hWnd=0x0, hDC=0x2c010660) returned 1 [0098.212] IUri:GetAbsoluteUri (in: This=0x2ed3a54, pbstrAbsoluteUri=0xcff3cc | out: pbstrAbsoluteUri=0xcff3cc*="file:///C:/Users/FD1HVy/Desktop/Info.hta") returned 0x0 [0098.212] GetCurrentProcessId () returned 0x764 [0098.213] GetCurrentThreadId () returned 0xb38 [0098.213] GetCurrentThreadId () returned 0xb38 [0098.213] GetCurrentProcessId () returned 0x764 [0098.213] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x10) returned 0x2eb9420 [0098.213] IUnknown:AddRef (This=0x2ec0e90) returned 0x2 [0098.213] IUnknown:Release (This=0x2ec0e90) returned 0x1 [0098.425] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x20) returned 0x2ed4680 [0098.425] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x94) returned 0x4e33c10 [0098.425] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0098.425] VirtualAlloc (lpAddress=0x4cb6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4cb6000 [0098.426] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0098.426] GetKeyboardLayoutNameW (in: pwszKLID=0xcfef30 | out: pwszKLID="00000409") returned 1 [0098.426] CreateUri (in: pwzURI="file:///C:/Users/FD1HVy/Desktop/Info.hta", dwFlags=0x3022b05, dwReserved=0x0, ppURI=0xcfef7c | out: ppURI=0xcfef7c*=0x2eb951c) returned 0x0 [0098.426] CreateIUriBuilder (in: pIUri=0x2eb951c, dwFlags=0x0, dwReserved=0x0, ppIUriBuilder=0xcfef78 | out: ppIUriBuilder=0xcfef78*=0x2eb9650) returned 0x0 [0098.427] IUriBuilder:RemoveProperties (This=0x2eb9650, dwPropertyMask=0x2020) returned 0x0 [0098.427] IUnknown:Release (This=0x2eb951c) returned 0x3 [0098.427] IUriBuilder:CreateUriSimple (in: This=0x2eb9650, dwAllowEncodingPropertyMask=0x0, dwReserved=0x0, ppIUri=0xcfef7c | out: ppIUri=0xcfef7c*=0x2eb951c) returned 0x0 [0098.427] IUri:GetPropertyBSTR (in: This=0x2eb951c, uriProp=0x0, pbstrProperty=0xcfef98, dwFlags=0x2 | out: pbstrProperty=0xcfef98*="file:///C:/Users/FD1HVy/Desktop/Info.hta") returned 0x0 [0098.427] IUnknown:Release (This=0x2eb951c) returned 0x3 [0098.427] IUnknown:Release (This=0x2eb9650) returned 0x0 [0098.427] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x56) returned 0x2eb9650 [0098.427] ParseURLW (in: pcszURL="file:///C:/Users/FD1HVy/Desktop/Info.hta", ppu=0xcfef68 | out: ppu=0xcfef68) returned 0x0 [0098.427] CreateUri (in: pwzURI="file:///C:/Users/FD1HVy/Desktop/Info.hta", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0xcfef48 | out: ppURI=0xcfef48*=0x2ed3a54) returned 0x0 [0098.427] IUnknown:AddRef (This=0x2ec0e90) returned 0x2 [0098.427] IUnknown:AddRef (This=0x2ed3a54) returned 0x6 [0098.427] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0098.427] IInternetSecurityManager:MapUrlToZone (in: This=0x6db3f4d4, pwszUrl="file:///C:/Users/FD1HVy/Desktop/Info.hta", pdwZone=0xcfeefc, dwFlags=0x0 | out: pdwZone=0xcfeefc*=0xffffffff) returned 0x800c0011 [0098.427] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0098.427] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0098.427] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0098.427] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x2ec0e90, pUri=0x2ed3a54, dwAction=0x2700, pPolicy=0xcfef00, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0xcfeee0 | out: pPolicy=0xcfef00*=0x0, pdwOutFlags=0xcfeee0*=0x0) returned 0x0 [0098.427] IInternetSecurityManager:ProcessUrlAction (in: This=0x6db3f4d4, pwszUrl="file:///C:/Users/FD1HVy/Desktop/Info.hta", dwAction=0x2700, pPolicy=0xcfef00, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0xcfef00*=0x0) returned 0x0 [0098.427] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0098.427] IUnknown:Release (This=0x2ec0e90) returned 0x1 [0098.427] IUnknown:Release (This=0x2ed3a54) returned 0x6 [0098.427] IUnknown:Release (This=0x2ed3a54) returned 0x5 [0098.427] IUnknown:AddRef (This=0x2ed3a54) returned 0x6 [0098.428] IUri:GetPropertyDWORD (in: This=0x2ed3a54, uriProp=0x11, pdwProperty=0xcfecf4, dwFlags=0x0 | out: pdwProperty=0xcfecf4*=0x9) returned 0x0 [0098.428] IUnknown:Release (This=0x2ed3a54) returned 0x5 [0098.428] IUnknown:AddRef (This=0x2ec0e90) returned 0x2 [0098.428] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x56) returned 0x2eb96b0 [0098.428] IUnknown:QueryInterface (in: This=0x6db3f4d4, riid=0x6e92a5cc*(Data1=0xc90db44a, Data2=0x1902, Data3=0x451e, Data4=([0]=0xbd, [1]=0xf0, [2]=0x5c, [3]=0x89, [4]=0x66, [5]=0xb, [6]=0x52, [7]=0x8c)), ppvObject=0xcfcc60 | out: ppvObject=0xcfcc60*=0x0) returned 0x80004002 [0098.428] IInternetSecurityManager:GetSecurityId (in: This=0x6db3f4d4, pwszUrl="file:///C:/Users/FD1HVy/Desktop/Info.hta", pbSecurityId=0xcfed88, pcbSecurityId=0xcfed80*=0x200, dwReserved=0x0 | out: pbSecurityId=0xcfed88*=0x0, pcbSecurityId=0xcfed80*=0x200) returned 0x800c0011 [0098.428] IUnknown:Release (This=0x2ec0e90) returned 0x1 [0098.428] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2eb96b0 | out: hHeap=0x2ea0000) returned 1 [0098.428] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xa) returned 0x2eb9138 [0098.428] memcpy_s (in: _Destination=0x2eb9138, _DestinationSize=0xa, _Source=0xcfed88, _SourceSize=0xa | out: _Destination=0x2eb9138) returned 0x0 [0098.428] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x56) returned 0x2eb96b0 [0098.428] IUri:GetPropertyBSTR (in: This=0x2ed3a54, uriProp=0x3, pbstrProperty=0xcff18c, dwFlags=0x2 | out: pbstrProperty=0xcff18c*="") returned 0x1 [0098.428] IUri:GetPropertyBSTR (in: This=0x2ed3a54, uriProp=0x6, pbstrProperty=0xcff18c, dwFlags=0x2 | out: pbstrProperty=0xcff18c*="") returned 0x1 [0098.428] CoInternetGetSession (in: dwSessionMode=0x0, ppIInternetSession=0xcff174, dwReserved=0x0 | out: ppIInternetSession=0xcff174*=0x2ec23b0) returned 0x0 [0098.428] IInternetSession:RegisterNameSpace (This=0x2ec23b0, pCF=0x6da2ba70, rclsid=0x6cb3d12c, pwzProtocol="res", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0098.428] IUnknown:AddRef (This=0x6da2ba70) returned 0x1 [0098.428] IInternetSession:RegisterNameSpace (This=0x2ec23b0, pCF=0x6da2ba90, rclsid=0x6cb3d14c, pwzProtocol="about", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0098.428] IUnknown:AddRef (This=0x6da2ba90) returned 0x1 [0098.428] IInternetSession:RegisterNameSpace (This=0x2ec23b0, pCF=0x6da2c164, rclsid=0x6cb3d13c, pwzProtocol="blob", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0098.428] IUnknown:AddRef (This=0x6da2c164) returned 0x1 [0098.428] UrlCanonicalizeW (in: pszUrl="file:///C:/Users/FD1HVy/Desktop/Info.hta", pszCanonicalized=0xcfe174, pcchCanonicalized=0xcfe170, dwFlags=0x10000000 | out: pszCanonicalized="file:///C:/Users/FD1HVy/Desktop/Info.hta", pcchCanonicalized=0xcfe170) returned 0x0 [0098.429] StrCmpICW (pszStr1="file:///C:/Users/FD1HVy/Desktop/Info.hta", pszStr2="res://ieframe.dll/PhishSite.htm") returned -12 [0098.429] StrCmpNIW (lpStr1="file:/", lpStr2="res://", nChar=6) returned -1 [0098.429] UrlCanonicalizeW (in: pszUrl="file:///C:/Users/FD1HVy/Desktop/Info.hta", pszCanonicalized=0xcfe174, pcchCanonicalized=0xcfe170, dwFlags=0x10000000 | out: pszCanonicalized="file:///C:/Users/FD1HVy/Desktop/Info.hta", pcchCanonicalized=0xcfe170) returned 0x0 [0098.429] StrCmpNIW (lpStr1="file:///C:/Use", lpStr2="ms-appx-web://", nChar=14) returned -1 [0098.429] StrCmpNIW (lpStr1="file:/", lpStr2="res://", nChar=6) returned -1 [0098.429] LoadLibraryExW (lpLibFileName="urlmon.dll", hFile=0x0, dwFlags=0x0) returned 0x6e920000 [0098.429] GetProcAddress (hModule=0x6e920000, lpProcName=0x1d7) returned 0x6e9a45d0 [0098.429] IUnknown:QueryInterface (in: This=0x2ec1ad4, riid=0x6cb40c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff0c8 | out: ppvObject=0xcff0c8*=0x2ec1ad4) returned 0x0 [0098.429] IUnknown:Release (This=0x2ec1ad4) returned 0xa [0098.429] IUnknown:AddRef (This=0x2ec1ad4) returned 0xb [0098.429] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0x90) returned 0x4e33cb0 [0098.429] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0098.430] VirtualAlloc (lpAddress=0x4cb8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4cb8000 [0098.430] IUnknown:AddRef (This=0x2ec1ad4) returned 0xc [0098.430] IUri:GetSchemeName (in: This=0x2ec1ad4, pbstrSchemeName=0xcff08c | out: pbstrSchemeName=0xcff08c*="file") returned 0x0 [0098.430] IUnknown:QueryInterface (in: This=0x2ec1ad4, riid=0x6cb40c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff078 | out: ppvObject=0xcff078*=0x2ec1ad4) returned 0x0 [0098.430] IUnknown:Release (This=0x2ec1ad4) returned 0xc [0098.430] IUnknown:AddRef (This=0x2ec1ad4) returned 0xd [0098.430] IUnknown:Release (This=0x2ec1ad4) returned 0xc [0098.430] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xa4) returned 0x4e33d48 [0098.430] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0098.430] VirtualAlloc (lpAddress=0x4cba000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4cba000 [0098.431] IUri:GetScheme (in: This=0x2ec1ad4, pdwScheme=0xcff144 | out: pdwScheme=0xcff144*=0x9) returned 0x0 [0098.431] IUri:IsEqual (in: This=0x2ed3a54, pUri=0x2ec1ad4, pfEqual=0xcff194 | out: pfEqual=0xcff194*=1) returned 0x0 [0098.431] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x12) returned 0x2ec22b8 [0098.431] LoadLibraryExW (lpLibFileName="WLDP.DLL", hFile=0x0, dwFlags=0x800) returned 0x6f260000 [0098.436] GetProcAddress (hModule=0x6f260000, lpProcName="WldpGetLockdownPolicy") returned 0x6f263c20 [0098.436] WldpGetLockdownPolicy () returned 0x10000000 [0098.437] RtlAllocateHeap (HeapHandle=0x4e20000, Flags=0x0, Size=0xac) returned 0x4e33df8 [0098.437] RtlInterlockedPopEntrySList (in: ListHead=0x4e20878 | out: ListHead=0x4e20878) returned 0x0 [0098.437] VirtualAlloc (lpAddress=0x4cbc000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4cbc000 [0098.437] PostMessageW (hWnd=0x102ca, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0098.437] IUnknown:AddRef (This=0x2ec23b0) returned 0x3 [0098.437] IUnknown:AddRef (This=0x2ec1ad4) returned 0xd [0098.438] IUnknown:QueryInterface (in: This=0x2ec1ad4, riid=0x6cb40c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff0bc | out: ppvObject=0xcff0bc*=0x2ec1ad4) returned 0x0 [0098.438] IUnknown:Release (This=0x2ec1ad4) returned 0xd [0098.438] IUnknown:AddRef (This=0x2ec1ad4) returned 0xe [0098.438] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x20) returned 0x2ed4860 [0098.438] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0xcfed8c, dwReserved=0x0 | out: ppSM=0xcfed8c*=0x2ec0410) returned 0x0 [0098.438] IUnknown:QueryInterface (in: This=0x2ec0410, riid=0x6cb2cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0xcfed90 | out: ppvObject=0xcfed90*=0x2ec0410) returned 0x0 [0098.438] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x14) returned 0x2ec2078 [0098.438] IInternetSecurityManager:SetSecuritySite (This=0x2ec0410, pSite=0x2ec207c) returned 0x0 [0098.438] IUnknown:AddRef (This=0x2ec207c) returned 0x2 [0098.438] IUnknown:QueryInterface (in: This=0x2ec207c, riid=0x6e92a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xcfed64 | out: ppvObject=0xcfed64*=0x2ec2078) returned 0x0 [0098.438] IServiceProvider:QueryService (in: This=0x2ec2078, guidService=0x6e92a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), riid=0x6e92a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), ppvObject=0x2ec0444 | out: ppvObject=0x2ec0444*=0x0) returned 0x80004002 [0098.438] IServiceProvider:QueryService (in: This=0x2ec2078, guidService=0x6e92a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x6e92a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x2ec0440 | out: ppvObject=0x2ec0440*=0x2ec2080) returned 0x0 [0098.438] IUnknown:Release (This=0x2ec2078) returned 0x3 [0098.438] IUnknown:AddRef (This=0x2ec0410) returned 0x3 [0098.439] IUnknown:Release (This=0x2ec0410) returned 0x2 [0098.439] IUnknown:Release (This=0x2ec0410) returned 0x1 [0098.439] ParseURLW (in: pcszURL="file:///C:/Users/FD1HVy/Desktop/Info.hta", ppu=0xcfed58 | out: ppu=0xcfed58) returned 0x0 [0098.439] CreateUri (in: pwzURI="file:///C:/Users/FD1HVy/Desktop/Info.hta", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0xcfeddc | out: ppURI=0xcfeddc*=0x2ed3cc4) returned 0x0 [0098.439] IUnknown:AddRef (This=0x2ed3cc4) returned 0x5 [0098.439] IUnknown:QueryInterface (in: This=0x2ed3cc4, riid=0x6cb40c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcfed68 | out: ppvObject=0xcfed68*=0x2ed3cc4) returned 0x0 [0098.439] IUnknown:Release (This=0x2ed3cc4) returned 0x5 [0098.439] IUnknown:AddRef (This=0x2ed3cc4) returned 0x6 [0098.439] IUnknown:QueryInterface (in: This=0x2ec1ad4, riid=0x6cb40c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcfed80 | out: ppvObject=0xcfed80*=0x2ec1ad4) returned 0x0 [0098.439] IUnknown:Release (This=0x2ec1ad4) returned 0xe [0098.439] IUnknown:AddRef (This=0x2ec1ad4) returned 0xf [0098.439] QueryPerformanceCounter (in: lpPerformanceCount=0xcfed18 | out: lpPerformanceCount=0xcfed18*=19060431658) returned 1 [0098.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfed20 | out: lpSystemTimeAsFileTime=0xcfed20*(dwLowDateTime=0x96ba4174, dwHighDateTime=0x1d69f56)) [0098.439] QueryPerformanceCounter (in: lpPerformanceCount=0xcfed78 | out: lpPerformanceCount=0xcfed78*=19060439384) returned 1 [0098.439] IUnknown:AddRef (This=0x2ec1ad4) returned 0x10 [0098.439] IUnknown:AddRef (This=0x2ec1ad4) returned 0x11 [0098.439] IUnknown:AddRef (This=0x2ec1ad4) returned 0x12 [0098.439] IUnknown:QueryInterface (in: This=0x2ec1ad4, riid=0x6cb40c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcfed64 | out: ppvObject=0xcfed64*=0x2ec1ad4) returned 0x0 [0098.440] IUnknown:Release (This=0x2ec1ad4) returned 0x12 [0098.440] IUnknown:AddRef (This=0x2ec1ad4) returned 0x13 [0098.440] IUri:GetScheme (in: This=0x2ec1ad4, pdwScheme=0x4ca0d98 | out: pdwScheme=0x4ca0d98*=0x9) returned 0x0 [0098.440] IMoniker:IsSystemMoniker (in: This=0x2ead0f8, pdwMksys=0xcfedb0 | out: pdwMksys=0xcfedb0*=0x6) returned 0x0 [0098.440] CoInternetParseIUri (in: pIUri=0x2ec1ad4, ParseAction=0x9, dwFlags=0x0, pwzResult=0xcfee18, cchResult=0x104, pcchResult=0xcfee10, dwReserved=0x0 | out: pwzResult="C:\\Users\\FD1HVy\\Desktop\\Info.hta", pcchResult=0xcfee10) returned 0x0 [0098.440] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x46) returned 0x2ebfd58 [0098.440] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Info.hta", lpFindFileData=0xcfeb40 | out: lpFindFileData=0xcfeb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936f2b3f, ftCreationTime.dwHighDateTime=0x1d69f56, ftLastAccessTime.dwLowDateTime=0x936f2b3f, ftLastAccessTime.dwHighDateTime=0x1d69f56, ftLastWriteTime.dwLowDateTime=0x936f2b3f, ftLastWriteTime.dwHighDateTime=0x1d69f56, nFileSizeHigh=0x0, nFileSizeLow=0x29584, dwReserved0=0x6f0066, dwReserved1=0x68002e, cFileName="Info.hta", cAlternateFileName="")) returned 0x2ed7440 [0098.440] FindClose (in: hFindFile=0x2ed7440 | out: hFindFile=0x2ed7440) returned 1 [0098.440] IUnknown:QueryInterface (in: This=0x2ec1ad4, riid=0x6cb40c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcfed80 | out: ppvObject=0xcfed80*=0x2ec1ad4) returned 0x0 [0098.440] IUnknown:Release (This=0x2ec1ad4) returned 0x13 [0098.440] IUnknown:AddRef (This=0x2ec1ad4) returned 0x14 [0098.440] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x56) returned 0x2eb9b38 [0098.440] IInternetSession:CreateBinding (in: This=0x2ec23b0, pbc=0x0, szUrl="file:///C:/Users/FD1HVy/Desktop/Info.hta", pUnkOuter=0x0, ppunk=0x0, ppOInetProt=0xcfec98, dwOption=0x0 | out: ppunk=0x0, ppOInetProt=0xcfec98*=0x2eba058) returned 0x0 [0098.441] IUnknown:QueryInterface (in: This=0x2eba058, riid=0x6cb82980*(Data1=0x53c84785, Data2=0x8425, Data3=0x4dc5, Data4=([0]=0x97, [1]=0x1b, [2]=0xe5, [3]=0x8d, [4]=0x9c, [5]=0x19, [6]=0xf9, [7]=0xb6)), ppvObject=0xcfec80 | out: ppvObject=0xcfec80*=0x0) returned 0x80004002 [0098.441] IUnknown:QueryInterface (in: This=0x2eba058, riid=0x6cb82970*(Data1=0xeb5cda44, Data2=0x5086, Data3=0x44fe, Data4=([0]=0xa9, [1]=0xb1, [2]=0xc6, [3]=0x42, [4]=0x13, [5]=0x53, [6]=0xa5, [7]=0x46)), ppvObject=0xcfec88 | out: ppvObject=0xcfec88*=0x2eba06c) returned 0x0 [0098.441] IUnknown:Release (This=0x2eba06c) returned 0x1 [0098.441] IUnknown:AddRef (This=0x2eba058) returned 0x2 [0098.441] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x8c) returned 0x2eb9b98 [0098.441] IUnknown:AddRef (This=0x2ec0410) returned 0x2 [0098.442] SHStrDupW (in: psz="file:///C:/Users/FD1HVy/Desktop/Info.hta", ppwsz=0x2eb9c10 | out: ppwsz=0x2eb9c10*="file:///C:/Users/FD1HVy/Desktop/Info.hta") returned 0x0 [0098.442] GetCurrentProcess () returned 0xffffffff [0098.442] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xcfec50 | out: TokenHandle=0xcfec50*=0x30c) returned 1 [0098.442] LdrResolveDelayLoadedAPI () returned 0x752d5560 [0098.443] ConvertSidToStringSidW () returned 0x1 [0098.443] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0xe2) returned 0x2eba550 [0098.443] _vsnwprintf (in: _Buffer=0x2eba550, _BufferCount=0x70, _Format="%s%s", _ArgList=0xcfec28 | out: _Buffer="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 111 [0098.443] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\S-1-5-21-1051304884-625712362-2192934891-1000", ulOptions=0x0, samDesired=0x101, phkResult=0xcfec44 | out: phkResult=0xcfec44*=0x0) returned 0x2 [0098.443] HeapFree (in: hHeap=0x2ea0000, dwFlags=0x0, lpMem=0x2eba550 | out: hHeap=0x2ea0000) returned 1 [0098.443] LocalFree (hMem=0x2eb9cf8) returned 0x0 [0098.443] LocalFree (hMem=0x2ed46a8) returned 0x0 [0098.443] CloseHandle (hObject=0x30c) returned 1 [0098.443] IUnknown:QueryInterface (in: This=0x2eba058, riid=0x6cba7568*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x2eb9c20 | out: ppvObject=0x2eb9c20*=0x2eba058) returned 0x0 [0098.443] IUnknown:QueryInterface (in: This=0x2eba058, riid=0x6cb2ca54*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x2eb9c00 | out: ppvObject=0x2eb9c00*=0x0) returned 0x80004002 [0098.443] IUnknown:Release (This=0x2eba058) returned 0x2 [0098.443] IInternetProtocolRoot:Start (This=0x2eba058, szUrl="file:///C:/Users/FD1HVy/Desktop/Info.hta", pOIProtSink=0x2eb9c18, pOIBindInfo=0x2eb9bd4, grfPI=0x10, dwReserved=0x0) returned 0x0 [0098.443] IUnknown:QueryInterface (in: This=0x2eb9c18, riid=0x6e92a920*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0xcfed24 | out: ppvObject=0xcfed24*=0x0) returned 0x80004002 [0098.443] IUnknown:AddRef (This=0x2eb9c18) returned 0x5 [0098.443] IUnknown:AddRef (This=0x2eb9bd4) returned 0x6 [0098.444] IUnknown:QueryInterface (in: This=0x2eb9bd4, riid=0x6e92a7bc*(Data1=0xa3e015b7, Data2=0xa82c, Data3=0x4dcd, Data4=([0]=0xa1, [1]=0x50, [2]=0x56, [3]=0x9a, [4]=0xee, [5]=0xed, [6]=0x36, [7]=0xab)), ppvObject=0xcfec30 | out: ppvObject=0xcfec30*=0x2eb9bd4) returned 0x0 [0098.444] IInternetBindInfoEx:GetBindInfoEx (in: This=0x2eb9bd4, grfBINDF=0x2eba248, pbindinfo=0x2eba254, grfBINDF2=0x2eba24c, pdwReserved=0x2eba250 | out: grfBINDF=0x2eba248*=0x20483, pbindinfo=0x2eba254, grfBINDF2=0x2eba24c*=0x20704000, pdwReserved=0x2eba250*=0x0) returned 0x0 [0098.444] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0xcfe75c, dwReserved=0x0 | out: ppSM=0xcfe75c*=0x2ec0890) returned 0x0 [0098.444] IUnknown:QueryInterface (in: This=0x2ec0890, riid=0x6cb2cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0xcfe764 | out: ppvObject=0xcfe764*=0x2ec0890) returned 0x0 [0098.445] IUnknown:Release (This=0x2ec0890) returned 0x1 [0098.445] IUnknown:Release (This=0x2ec0890) returned 0x0 [0098.445] IUnknown:Release (This=0x2eb9bd4) returned 0x6 [0098.445] IUnknown:AddRef (This=0x2eb9c18) returned 0x7 [0098.445] IInternetProtocolSink:ReportProgress (This=0x2eb9c18, ulStatusCode=0x1e, szStatusText=0x0) returned 0x0 [0098.445] IUnknown:Release (This=0x2eb9c18) returned 0x6 [0098.445] IUnknown:AddRef (This=0x2eb9c18) returned 0x7 [0098.445] IInternetProtocolSink:ReportProgress (This=0x2eb9c18, ulStatusCode=0xb, szStatusText="") returned 0x0 [0098.445] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe5c0 | out: lpPerformanceCount=0xcfe5c0*=19061052165) returned 1 [0098.445] IUnknown:Release (This=0x2eb9c18) returned 0x6 [0098.446] IUnknown:AddRef (This=0x2eb9c18) returned 0x7 [0098.446] IInternetProtocolSink:ReportProgress (This=0x2eb9c18, ulStatusCode=0x3f, szStatusText="169348") returned 0x0 [0098.446] _wtoi64 (_String="169348") returned 169348 [0098.446] IUnknown:Release (This=0x2eb9c18) returned 0x6 [0098.446] IUnknown:AddRef (This=0x2eb9c18) returned 0x7 [0098.446] IInternetProtocolSink:ReportProgress (This=0x2eb9c18, ulStatusCode=0xe, szStatusText="C:\\Users\\FD1HVy\\Desktop\\Info.hta") returned 0x0 [0098.446] GetCurrentProcessId () returned 0x764 [0098.446] IUnknown:Release (This=0x2eb9c18) returned 0x6 [0098.446] IUnknown:AddRef (This=0x2eb9c18) returned 0x7 [0098.446] IInternetProtocolSink:ReportProgress (This=0x2eb9c18, ulStatusCode=0xd, szStatusText="application/hta") returned 0x0 [0098.446] RegisterClipboardFormatW (lpszFormat="text/html") returned 0xc108 [0098.446] RegisterClipboardFormatW (lpszFormat="text/plain") returned 0xc109 [0098.447] RegisterClipboardFormatW (lpszFormat="text/xml") returned 0xc12d [0098.447] RegisterClipboardFormatW (lpszFormat="application/xml") returned 0xc12e [0098.447] RegisterClipboardFormatW (lpszFormat="application/xhtml+xml") returned 0xc12f [0098.447] RegisterClipboardFormatW (lpszFormat="text/x-component") returned 0xc1b0 [0098.447] RegisterClipboardFormatW (lpszFormat="image/svg+xml") returned 0xc130 [0098.447] RegisterClipboardFormatW (lpszFormat="video/avi") returned 0xc121 [0098.447] RegisterClipboardFormatW (lpszFormat="video/x-msvideo") returned 0xc122 [0098.447] RegisterClipboardFormatW (lpszFormat="video/mpeg") returned 0xc123 [0098.447] RegisterClipboardFormatW (lpszFormat="video/quicktime") returned 0xc1b1 [0098.447] RegisterClipboardFormatW (lpszFormat="application/hta") returned 0xc1b2 [0098.447] RegisterClipboardFormatW (lpszFormat="text/cache-manifest") returned 0xc1b3 [0098.447] RegisterClipboardFormatW (lpszFormat="text/vtt") returned 0xc1b4 [0098.447] RegisterClipboardFormatW (lpszFormat="application/ttml+xml") returned 0xc1b5 [0098.447] RegisterClipboardFormatW (lpszFormat="application/ttaf+xml") returned 0xc1b6 [0098.447] RegisterClipboardFormatW (lpszFormat="text/json") returned 0xc1b7 [0098.447] RegisterClipboardFormatW (lpszFormat="application/x-javascript") returned 0xc1b8 [0098.447] RegisterClipboardFormatW (lpszFormat="image/x-png") returned 0xc118 [0098.447] RegisterClipboardFormatW (lpszFormat="image/png") returned 0xc119 [0098.447] RegisterClipboardFormatW (lpszFormat="image/jpeg") returned 0xc115 [0098.447] RegisterClipboardFormatW (lpszFormat="image/pjpeg") returned 0xc114 [0098.447] RegisterClipboardFormatW (lpszFormat="image/gif") returned 0xc113 [0098.447] RegisterClipboardFormatW (lpszFormat="image/vnd.ms-dds") returned 0xc1b9 [0098.447] RegisterClipboardFormatW (lpszFormat="image/svg+xml") returned 0xc130 [0098.447] RegisterClipboardFormatW (lpszFormat="image/tiff") returned 0xc117 [0098.447] RegisterClipboardFormatW (lpszFormat="image/bmp") returned 0xc11a [0098.447] RegisterClipboardFormatW (lpszFormat="image/vnd.ms-photo") returned 0xc11f [0098.447] RegisterClipboardFormatW (lpszFormat="image/x-wmf") returned 0xc11d [0098.447] RegisterClipboardFormatW (lpszFormat="image/x-emf") returned 0xc11c [0098.447] RegisterClipboardFormatW (lpszFormat="image/x-icon") returned 0xc11e [0098.646] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe4a8 | out: lpPerformanceCount=0xcfe4a8*=19081084175) returned 1 [0098.646] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe470 | out: lpPerformanceCount=0xcfe470*=19081091110) returned 1 [0098.646] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x24) returned 0x2ec3300 [0098.681] StrChrW (lpStart="application/hta", wMatch=0x3b) returned 0x0 [0098.681] StrCmpNICW (lpStr1="text/", lpStr2="appli", nChar=5) returned 19 [0098.681] StrCmpNICW (lpStr1="application/", lpStr2="application/", nChar=12) returned 0 [0098.681] IUnknown:Release (This=0x2eb9c18) returned 0x6 [0098.681] IUnknown:AddRef (This=0x2eb9c18) returned 0x7 [0098.681] IUnknown:AddRef (This=0x2eb9c18) returned 0x8 [0098.681] IInternetProtocolSink:ReportData (This=0x2eb9c18, grfBSCF=0x5, ulProgress=0x29584, ulProgressMax=0x29584) returned 0x0 [0098.681] IUnknown:QueryInterface (in: This=0x2eba058, riid=0x6cb2d4b0*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfc888 | out: ppvObject=0xcfc888*=0x0) returned 0x80004002 [0098.681] IUnknown:QueryInterface (in: This=0x2eba058, riid=0x6cb2d4d8*(Data1=0x79eac9d6, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfc898 | out: ppvObject=0xcfc898*=0x0) returned 0x80004002 [0098.682] IUnknown:Release (This=0x2eb9c18) returned 0x7 [0098.682] IUnknown:AddRef (This=0x2eb9c18) returned 0x8 [0098.682] IInternetProtocolSink:ReportResult (This=0x2eb9c18, hrResult=0x0, dwError=0x0, szResult=0x0) returned 0x0 [0098.682] IUnknown:Release (This=0x2eb9c18) returned 0x7 [0098.682] IUnknown:Release (This=0x2eb9c18) returned 0x6 [0098.682] IUnknown:Release (This=0x2ec0410) returned 0x1 [0098.682] IUnknown:Release (This=0x2ed3cc4) returned 0x5 [0098.682] IUnknown:Release (This=0x2ec1ad4) returned 0x13 [0098.682] IUnknown:Release (This=0x2ec1ad4) returned 0x12 [0098.682] IUnknown:Release (This=0x2ec1ad4) returned 0x11 [0098.682] CoTaskMemFree (pv=0x0) [0098.682] GetCurrentThreadId () returned 0xb38 [0098.682] GetCurrentProcessId () returned 0x764 [0098.682] GetCurrentThreadId () returned 0xb38 [0098.685] memcpy_s (in: _Destination=0xcff0b4, _DestinationSize=0xc, _Source=0x4ca0ce0, _SourceSize=0xc | out: _Destination=0xcff0b4) returned 0x0 [0098.685] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x52) returned 0x2eb9c90 [0098.685] MulDiv (nNumber=169348, nNumerator=4000, nDenominator=169348) returned 4000 [0098.686] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x46) returned 0x2ebfb78 [0098.686] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x24) returned 0x2ec3360 [0098.686] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x100) returned 0x2eba550 [0098.686] IUnknown:QueryInterface (in: This=0x2eba058, riid=0x6cba7568*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfee2c | out: ppvObject=0xcfee2c*=0x2eba058) returned 0x0 [0098.686] IInternetProtocol:Read (in: This=0x2eba058, pv=0x2eba55c, cb=0xc8, pcbRead=0xcfef20 | out: pv=0x2eba55c, pcbRead=0xcfef20*=0xc8) returned 0x0 [0099.063] IUnknown:Release (This=0x2eba058) returned 0x2 [0099.063] memcpy_s (in: _Destination=0xcfefc8, _DestinationSize=0xc8, _Source=0x2eba55c, _SourceSize=0xc8 | out: _Destination=0xcfefc8) returned 0x0 [0099.063] CoInternetIsFeatureEnabledForUrl (FeatureEntry=0x3, dwFlags=0x2, szURL="file:///C:/Users/FD1HVy/Desktop/Info.hta", pSecMgr=0x0) returned 0x1 [0099.063] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0xcfeaa8, dwReserved=0x0 | out: ppSM=0xcfeaa8*=0x2ec0290) returned 0x0 [0099.063] IUnknown:QueryInterface (in: This=0x2ec0290, riid=0x6cb2cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0xcfeab0 | out: ppvObject=0xcfeab0*=0x2ec0290) returned 0x0 [0099.064] IUnknown:Release (This=0x2ec0290) returned 0x1 [0099.064] IUnknown:Release (This=0x2ec0290) returned 0x0 [0099.064] ReleaseBindInfo (pbindinfo=0xcfef70) [0099.064] FindMimeFromData (in: pBC=0x0, pwzUrl="C:\\Users\\FD1HVy\\Desktop\\Info.hta", pBuffer=0xcfefc8, cbSize=0xc8, pwzMimeProposed="application/hta", dwMimeFlags=0x6, ppwzMimeOut=0xcfef20, dwReserved=0x0 | out: ppwzMimeOut=0xcfef20*="application/hta") returned 0x0 [0099.065] CoTaskMemFree (pv=0x2ed46d0) [0099.065] CoInternetIsFeatureEnabledForUrl (FeatureEntry=0x3, dwFlags=0x2, szURL="file:///C:/Users/FD1HVy/Desktop/Info.hta", pSecMgr=0x0) returned 0x1 [0099.065] StrCmpNIW (lpStr1="applic", lpStr2="image/", nChar=6) returned -1 [0099.065] GetCurrentThreadId () returned 0xb38 [0099.066] GetCurrentThreadId () returned 0xb38 [0099.066] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xcfee54 | out: lpCPInfo=0xcfee54) returned 1 [0099.066] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="application/hta", cchCount1=7, lpString2="charset", cchCount2=7) returned 1 [0099.066] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x0, Size=0x1006) returned 0x2eba658 [0099.066] memcpy_s (in: _Destination=0x2eba658, _DestinationSize=0x1000, _Source=0x2eba55c, _SourceSize=0xc8 | out: _Destination=0x2eba658) returned 0x0 [0099.066] RtlReAllocateHeap (Heap=0x2ea0000, Flags=0x0, Ptr=0x2eba550, Size=0x4000) returned 0x2ed7fe8 [0099.067] IUnknown:QueryInterface (in: This=0x2eba058, riid=0x6cba7568*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfed0c | out: ppvObject=0xcfed0c*=0x2eba058) returned 0x0 [0099.067] IInternetProtocol:Read (in: This=0x2eba058, pv=0x2ed80bc, cb=0xf38, pcbRead=0xcfee00 | out: pv=0x2ed80bc, pcbRead=0xcfee00*=0xf38) returned 0x0 [0099.067] IUnknown:Release (This=0x2eba058) returned 0x2 [0099.067] memcpy_s (in: _Destination=0x2eba720, _DestinationSize=0xf38, _Source=0x2ed80bc, _SourceSize=0xf38 | out: _Destination=0x2eba720) returned 0x0 [0099.067] RtlAllocateHeap (HeapHandle=0x2ea0000, Flags=0x8, Size=0x2000) returned 0x2edbff0 [0099.067] IsCharSpaceW (wch=0x63) returned 0 [0099.067] IsCharSpaceW (wch=0x63) returned 0 [0099.067] IsCharSpaceW (wch=0x68) returned 0 [0099.067] IsCharSpaceW (wch=0x61) returned 0 [0099.067] IsCharSpaceW (wch=0x72) returned 0 [0099.067] IsCharSpaceW (wch=0x73) returned 0 [0099.067] IsCharSpaceW (wch=0x65) returned 0 [0099.067] IsCharSpaceW (wch=0x74) returned 0 [0099.067] IsCharSpaceW (wch=0x3d) returned 0 [0099.067] IsCharSpaceW (wch=0x3d) returned 0 [0099.067] IsCharSpaceW (wch=0x27) returned 0 [0099.068] CoGetApartmentType (in: pAptType=0xcfeda8, pAptQualifier=0xcfedac | out: pAptType=0xcfeda8, pAptQualifier=0xcfedac) returned 0x0 [0099.068] CoCreateInstance (in: rclsid=0x6cb82ae4*(Data1=0x275c23e2, Data2=0x3747, Data3=0x11d0, Data4=([0]=0x9f, [1]=0xea, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3f, [6]=0x86, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6cb82af4*(Data1=0xdccfc164, Data2=0x2b38, Data3=0x11d2, Data4=([0]=0xb7, [1]=0xec, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x8f, [6]=0x5d, [7]=0x9a)), ppv=0x6da27174 | out: ppv=0x6da27174*=0xdf94b0) returned 0x0 [0099.072] IUnknown:QueryInterface (in: This=0xdf94b0, riid=0x6cb82ad4*(Data1=0x359f3441, Data2=0xbd4a, Data3=0x11d0, Data4=([0]=0xb1, [1]=0x88, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x38, [6]=0xc9, [7]=0x69)), ppvObject=0x6da27178 | out: ppvObject=0x6da27178*=0xdf0528) returned 0x0 [0099.072] IUnknown:QueryInterface (in: This=0xdf94b0, riid=0x6cb82ac4*(Data1=0xdccfc162, Data2=0x2b38, Data3=0x11d2, Data4=([0]=0xb7, [1]=0xec, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x8f, [6]=0x5d, [7]=0x9a)), ppvObject=0x6da2717c | out: ppvObject=0x6da2717c*=0xdf9560) returned 0x0 [0099.072] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0xcfee08 | out: lpCPInfo=0xcfee08) returned 1 [0099.073] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x2eba658, cbMultiByte=4096, lpWideCharStr=0x2edbff0, cchWideChar=4096 | out: lpWideCharStr="\r\n\r\n
\r\n \r\n